DevTools is designed to switch itself off when you run a fully packaged application, for example with java -jar, so it is normally inert in production. But Spring says forcing it on in production is a security risk. The safer practice is to keep it out of the production artifact entirely.
How it decides
The Spring Boot docs say developer tools are automatically disabled when running a fully packaged application. If the app is launched from java -jar, or from a special classloader, it counts as a production application. You can control this with the system property spring.devtools.restart.enabled.
Setting that property to true makes devtools run regardless of the classloader. The docs state that this must not be done in a production environment, where running devtools is a security risk. To disable devtools you can exclude the dependency or set the property to false.
Why leaving it in is still unwise
The automatic switch depends on how the app is started. Exploded directories, certain container setups, custom launchers and debug flags can change the launch path. Code that should only exist on a developer laptop should not be in a deployable file at all.
| Practice | Effect |
|---|---|
| Rely on automatic disable | Works for the common java -jar case |
| Exclude from packaged artifact | Removes the risk instead of relying on startup behaviour |
| Set restart enabled to true in production | Documented as a security risk |
Keep it out of the build
The docs say flagging the dependency as optional in Maven, or using the developmentOnly configuration in Gradle, prevents devtools from being applied transitively to other modules that use your project. The Maven plugin documentation adds that the devtools and docker compose modules are excluded by default when repackaging, controllable through the excludeDevtools property.
Steps
- Declare devtools as optional in Maven or developmentOnly in Gradle.
- Leave the repackage exclusion at its default.
- After a build, list the contents of the jar and confirm no devtools jar is present. Our guide to fat jar contents shows how.
- Search deployment scripts for the restart enabled property set to true.
- Add a check in CI that fails if devtools appears in the dependency tree of the packaged app.
- Generate an SBOM from the built artifact, not the source tree, so what you inspect matches what ships.
Try it yourself
Click through it at your own pace, or open it full screen. Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Does java -jar disable devtools?
Yes, per the Spring Boot docs a fully packaged application launched that way is treated as production and devtools is disabled.
Can I enable devtools in production for debugging?
The docs say not to. It is described as a security risk.
Sources
Last reviewed: 19 October 2026.
