add-prod-local-profiles

To separate Spring Boot Actuator configuration for dev and prod, split your YAML files into application-local.yaml and application-prod.yaml, restricting prod to health and info on a dedicated management port while exposing all endpoints locally.

You can restrict Actuator endpoints in production by creating an application-prod.yaml profile that limits exposure to health and info on port 8081, while application-local.yaml exposes all endpoints for local debugging.

Spring Boot 4 does not strictly require a separate management port, but isolating Actuator on a dedicated port like 8081 is a recommended enterprise lockdown strategy to prevent management endpoint exposure on the primary application port.

To enable Swagger UI locally without exposing it in production, use application-local.yaml to activate SpringDoc OpenAPI JSON and Swagger UI, while keeping the application-prod.yaml profile restricted to prevent public API documentation exposure.

You can secure Spring Boot Actuator without altering security filters by applying YAML-only configuration changes that restrict endpoint exposure to health and info and isolate the management port, avoiding any Java security filter modifications.

Your Spring Boot application likely exposes full Actuator details in production because the base application.yaml lacks a locked-down prod profile; setting show-details to never globally and restricting prod endpoints prevents this information leakage.