cubic
Try cubic for free

Lock Down Spring Boot Actuator, Secrets, and CORS

Flags exposed Actuator endpoints such as heapdump and env, secrets committed to application.yml, and CORS rules that allow any origin with credentials.

Catch this in your code

What it flags

Flaggedsrc/main/resources/application.yml
spring:
  datasource:
    url: jdbc:postgresql://orders-db.internal:5432/orders
    username: orders_app
    password: orders-prod-2025
app:
  jwt:
    secret: ${JWT_SECRET:dev-signing-key}
management:
  endpoints:
    web:
      exposure:
        include: "*" # exposes heapdump, env, and every other enabled endpoint
  endpoint:
    env:
      show-values: always
    health:
      show-details: always
Passessrc/main/resources/application.yml
spring:
  datasource:
    url: ${DATABASE_URL}
    username: ${DATABASE_USERNAME}
    password: ${DATABASE_PASSWORD}
app:
  jwt:
    secret: ${JWT_SECRET}
management:
  server:
    port: 8081
  endpoints:
    web:
      exposure:
        include: health,info,prometheus
  endpoint:
    health:
      show-details: when-authorized

Why it matters

The heapdump endpoint returns a dump of the JVM heap, which can contain database passwords, tokens, and session data in plain text. A secret committed to application.yml stays in Git history after the file is fixed, so the credential has to be rotated. Spring rejects allowedOrigins("*") combined with allowCredentials(true), and the usual workaround, allowedOriginPatterns("*"), lets any website make requests with the user's cookies and read the responses. None of this shows up in tests, because the application behaves the same with or without the exposure.

Agent instructions

cubic checks every pull request against these instructions. Paste them into AGENTS.md or Cursor rules and your AI coding tool follows them while it writes code.

AGENTS.md

Add this section to AGENTS.md at the repository root. Codex, Cursor, and other AI coding tools read it.

## Lock Down Spring Boot Actuator, Secrets, and CORS

Applies to `**/application*.yml`, `**/application*.yaml`, `**/application*.properties`, `**/*.java`.

Review Spring Boot configuration and web security setup for exposed Actuator endpoints, committed secrets, and CORS rules that let other sites make credentialed requests.

Flag changes that:
- Set `management.endpoints.web.exposure.include` to `"*"`, or expose `env`, `heapdump`, `threaddump`, `configprops`, `loggers`, or `shutdown` over HTTP without a security rule restricting them.
- Set `show-values` to `always` for the `env` or `configprops` endpoint, or `management.endpoint.health.show-details` to `always` on a publicly reachable health endpoint.
- Permit Actuator paths beyond health and info in a custom `SecurityFilterChain`, for example `EndpointRequest.toAnyEndpoint().permitAll()`.
- Commit passwords, API keys, JWT signing keys, or OAuth client secrets in `application.yml`, `application.properties`, or profile variants such as `application-prod.yml`.
- Give a secret placeholder a usable default, such as `${JWT_SECRET:changeme}`, so a missing environment variable starts the app with a known secret.
- Combine `allowCredentials(true)` with `allowedOriginPatterns("*")`, or echo the request `Origin` header back, in `CorsConfiguration`, `WebMvcConfigurer`, or `@CrossOrigin`.

Do not flag:
- Local-only credentials in test resources or a local profile that point at localhost, Docker Compose, or Testcontainers.
- Actuator endpoints exposed only on a separate `management.server.port` that is not publicly routed, or restricted to an operations role.
- `allowedOrigins("*")` without credentials on public, read-only APIs.

Checks files matching **/application*.yml, **/application*.yaml, **/application*.properties, **/*.java.

More Spring Boot agents

See all Spring Boot code review standards

Run this agent on every pull request

cubic reviews every pull request against the agents you turn on and comments on the lines that break them.

Catch this in your code