Spring Boot Actuator endpoint exposure

Spring Boot Actuator: the wildcard is the bug, not the endpoint that sounds scary

A dev.to post, published twice by the same author, argues that switching off env and heapdump while leaving exposure.include set to the wildcard is worse than no policy. The subtraction backs it up.