Spring Boot settings decide what the outside world can reach: one line exposes Actuator's heapdump endpoint (every secret in memory, downloadable), another drops your tables on every restart (ddl-auto: create-drop). This skill finds those and eight other configuration mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your application*.properties, application*.yml and bootstrap files. It understands .properties escapes and continuation lines, YAML nesting and lists, multi-document files, profile files (application-prod.yml) and Spring's relaxed names (ddl-auto, ddl_auto and ddlAuto are the same). Dev and test profiles are allowed the H2 console and SQL logging. It never starts your application. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• J01: a password, secret, token or API key in the file, in a ${VAR:default} fallback, or inside a database URL

• J02: Actuator endpoints such as heapdump, env, configprops, shutdown or gateway exposed over HTTP, or '*'

• J03: spring.h2.console.enabled=true

• J04: Hibernate ddl-auto create, create-drop or drop-and-create

REVIEW (check before release)

• J11: root, Spring, Hibernate or HTTP client logging at DEBUG or TRACE, or show-sql on

• J12: stack traces, exception names or messages in error responses

• J13: session cookie secure or http-only turned off

• J14: TLSv1, TLSv1.1 or SSL allowed, or mail set to trust every certificate

• J15: allowed-origins '*' (Actuator, Spring Cloud Gateway or your own CORS properties)

• J16: Actuator show-details or show-values set to always

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example config files (YAML, properties and a dev profile), and the real report the scanner produces on the risky ones

Limits

It reads the files as written, so environment variables, a config server, @Value defaults and security rules in Java code are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 10 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (4 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.