Spring Security with Spring Boot Actuator: the authorization model that survived the incident


68% of security misconfigs in Spring Boot come from configuration that looks secure because it doesn't throw an error. Yeah, read that again. No exception, no warning in the log, nothing. The endpoint just responds 200 and you don't find out until...