By default, yes. Spring Boot Actuator fully sanitizes values returned by the env, configprops and quartz endpoints, replacing them with asterisks. Values appear only if the show-values property is set to something other than never and no custom SanitizingFunction bean applies. Check that property before exposing those endpoints.
What sanitization is
Sanitization means the endpoint still lists property names but masks the values. An attacker who reaches a masked endpoint learns the shape of your configuration, such as which services you connect to, but not the secrets themselves. Masking is a safety net, not a licence to expose the endpoint.
The three settings
The Spring Boot docs describe a show-values property for sanitizable endpoints:
| Value | Effect |
|---|---|
| never | Values are always replaced by asterisks (the default) |
| always | Values are shown to all users who can reach the endpoint |
| when-authorized | Values are shown only to authorized users |
For HTTP endpoints, a user counts as authorized if they have authenticated and have the roles configured for the endpoint. If no roles are configured, any authenticated user counts as authorized. That second sentence is the one to read twice. A developer account or a service account with no special rights may then see real values.
The docs give this example for letting only an admin role see original values:
management.endpoint.env.show-values=when-authorized
management.endpoint.env.roles=admin
Why teams turn it on
Debugging a bad property value is much easier with real values, and the docs call env and configprops useful for diagnosing why a property has a certain value. The risk is that the same view shows database passwords, API keys and signing secrets to whoever is allowed in.
Steps
- Find every
show-valuesandshow-detailssetting in your configuration, including per environment profiles. - Prefer never in production. Use when-authorized with an explicit, narrow role if you must see values.
- Do not treat masking as a guarantee. Custom SanitizingFunction beans can change what is shown, so review any you have.
- Keep secrets out of plain property files in the first place, using a secret store or mounted files.
- Limit exposure with the include property, and put the endpoints behind authentication.
- Rotate any secret that was ever visible through an exposed endpoint.
Related reading: Actuator exposure and access.
Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is the default safe enough to expose env publicly?
No. Even masked, the endpoint reveals configuration structure. Only health is exposed over HTTP by default for that reason.
Who sees values with when-authorized and no roles set?
Any authenticated user, according to the Spring Boot docs.
Sources
Last reviewed: 19 October 2026.
