عرض عملي: تحصين ملف prod

خطوة بخطوة

1. Create application-prod.yml; replace secrets with environment variables.
2. Restrict Actuator to health,info.
3. Add security headers and HSTS; set forwarded-header handling for the proxy.
4. Add the dependency scanner to the build and run it; read the report.
5. Planned mistake: leaving management.endpoints.web.exposure.include=* from development; /actuator/env shows config. Fix: restrict it and re-test.
6. Grep the logs for passwords and tokens.