Introduction

Spring Boot Actuator intentionally sanitizes sensitive values in endpoints like /actuator/env to reduce accidental secret leakage. If you see masked values, this is usually expected security behavior rather than a misconfiguration. During debugging, teams sometimes try to fully unmask properties, but that can expose credentials in logs, dashboards, or shared environments. The better approach is to control endpoint exposure per environment, use targeted reveal settings only when justified, and keep production defaults restrictive. This article explains how sanitization works and how to debug configuration safely.

Core Sections

Understand default sanitization behavior

Actuator sanitizes keys that look sensitive, such as passwords, tokens, and secrets.

management.endpoints.web.exposure.include=health,info,env

Even with endpoint exposure enabled, sensitive values may appear as masked placeholders.

Configure visibility intentionally

If you need more detail in a secure internal environment, configure show-values behavior carefully.

management.endpoint.env.show-values=when_authorized
management.endpoint.configprops.show-values=when_authorized

Pair this with proper Spring Security role checks so only authorized users can access detailed values.

Add endpoint security controls

Protect Actuator endpoints with authentication and least privilege.

1@Bean
2SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
3    http
4      .securityMatcher("/actuator/**")
5      .authorizeHttpRequests(auth -> auth
6          .requestMatchers("/actuator/health", "/actuator/info").permitAll()
7          .anyRequest().hasRole("ACTUATOR_ADMIN"))
8      .httpBasic();
9    return http.build();
10}

This allows safe operational access without broad public exposure.

Use safer debugging alternatives

When investigating config issues, prefer:

• targeted logs for specific non-secret properties,
• startup diagnostics in secure environments,
• configuration metadata validation tests.

Avoid globally unmasking values in shared or production systems.

Separate dev and prod behavior

Use profile-specific config. For local debugging, you can allow more detail; for production, keep strict masking and minimal endpoint exposure.

# application-prod.properties
management.endpoints.web.exposure.include=health,info
management.endpoint.env.show-values=never

Common Pitfalls

• Treating masked env values as an application bug instead of expected Actuator security behavior.
• Unmasking all values in production for convenience and exposing secrets to unintended consumers.
• Exposing /actuator/env publicly without authentication or role-based authorization.
• Forgetting profile-specific overrides, causing local debug settings to leak into production.
• Debugging config by reading secrets directly instead of validating effective non-secret settings.

Verification Workflow

After implementing the main approach, run a short verification loop that proves behavior on realistic and adversarial inputs. Start with a small happy-path sample that should always pass, then add one edge case and one failure case that should be rejected or handled gracefully. Capture concrete outputs instead of relying on visual inspection alone. For operational code, record one measurable signal such as runtime, memory use, or error count so you can compare before and after future refactors.

Use this quick template during local development and CI:

11. Prepare deterministic sample input
22. Run expected-success scenario
33. Run expected-edge scenario
44. Run expected-failure scenario
55. Assert output schema and key values
66. Record one performance or reliability metric

This discipline catches most regressions caused by dependency upgrades, environment differences, or hidden assumptions in helper functions. It also makes handoffs easier because another engineer can reproduce behavior quickly without reverse-engineering your intent from source code alone.

Deployment Notes

Before rolling this pattern into production, add one small automated regression check tied to your most critical user path. Keep the check deterministic and fast, and run it on every dependency or configuration change. This extra guardrail catches subtle behavior drift that static review often misses, especially when environments differ between local machines and CI runners.

Summary

Actuator hides property values by design to protect sensitive configuration. Keep that default posture in production, and only reveal values under controlled authorization when necessary. Combine secure endpoint exposure, role-based access, and environment-specific settings to balance observability with security. With this setup, you can debug configuration safely without compromising secret management.