Metrics, Actuator and pprof are for you, not for the internet

Prometheus metrics at /metrics, Spring Boot Actuator at /actuator/*, and Go pprof at /debug/pprof are all diagnostic surfaces. None of them are meant to be public, and all of them commonly are — because adding the dependency registers the routes for you.

Go is the clearest example: importing net/http/pprof attaches the handlers to the default mux as a side effect of the import. Nobody writes a line of code to expose it.

Metrics: your internal route names, request volumes, error rates, and library versions. A map of your system and how busy it is.

Actuator: depends on which endpoints are enabled. /actuator/env prints every configuration property — database URLs, API keys, mail credentials — in plain text. Treat it as a credential leak, not an information leak.

pprof: lets anyone trigger a CPU or heap profile. That is both an information leak and a cheap way to load your server.

Bind them to localhost or an internal interface so they are not routable from outside. For Spring, set management.endpoints.web.exposure.include=health,info and put management on a separate port. For Go, register pprof on your own internal mux rather than the default one.

If your platform cannot bind separately, require authentication on the paths at the proxy or CDN.

From outside your network — a phone on mobile data works — request each path. You want 401, 403, or nothing at all. A 200 means it is still open.