Spring Boot 3.5

Apply the Java 21 baseline first. These rules cover Spring Boot 3.5.16 auto-configuration, external configuration, embedded servers, and Actuator. For servlet controller code, also apply the Spring MVC 6.2 prompt for routing, binding, CORS, and multipart rules. For WebFlux controllers and functional endpoints, configure CORS and CSRF at the reactive HTTP boundary as described below.

Configuration ownership

• Treat command-line arguments, system properties, environment variables, imported files, and remote configuration as privileged because higher-precedence property sources can replace packaged security settings.
• Allowlist spring.config.import locations; optional: can hide missing production policy, while configtree: maps mounted filenames directly into configuration keys.
• Bind security configuration with validated @ConfigurationProperties, fail on missing production values, and avoid permissive placeholder defaults for issuer, origin, proxy, TLS, or credentials.
• Keep secrets out of /env, /configprops, startup logs, failure analyzers, build metadata, and image layers even when Actuator masks displayed values.
• Separate developer and production profiles, and prevent request data from choosing spring.profiles.active, config imports, bean conditions, or feature flags.

Auto-configuration and server boundaries

• Remember that declaring a servlet SecurityFilterChain or reactive SecurityWebFilterChain backs off Boot's default web-security rules; provide a complete catch-all chain and separately secure Actuator endpoints. Configure production