shangeyao opened a new pull request, #4389: URL: https://github.com/apache/streampark/pull/4389
## Summary - Require JWT for `/actuator/**` (except health/info), `/h2-console/**`, and `/metrics/**` - Keep `/actuator/health` and `/actuator/info` anonymous for health probes - Add `SecurityStartupRunner` to warn when H2 embedded DB is used with default credentials Fixes #4388 ## Test plan - [ ] Unauthenticated `/actuator/health` returns 200 - [ ] Unauthenticated `/actuator/env` returns 401 - [ ] Startup log shows H2 security warning when using embedded database --- **AI Disclosure** - Model: Claude Opus 4.6 - Platform/Tool: Cursor - Human Oversight: partially reviewed - Prompt Summary: Harden default security from dev branch optimization scan Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
