Spring Boot spring.h2.console.enabled=true outside dev
Rule ID: vetkit.spring.h2.console-enabled
The H2 web console is enabled (spring.h2.console.enabled=true) in a configuration that is not limited to a development profile. The console runs arbitrary SQL with the application's database credentials and its JDBC URL field can load remote code.
Last updated:
Suite: Security
regex
The H2 web console is enabled (spring.h2.console.enabled=true) in a configuration that is not limited to a development profile. The console runs arbitrary SQL with the application's database credentials and its JDBC URL field can load remote code.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Move spring.h2.console.enabled=true to application-dev.properties (or a spring.config.activate.on-profile: dev document) so it never ships with production builds.
References
Source: packages/engine/rules/sast/config.yml.
Related checks
- Spring Boot YAML h2 console enabled: true outside dev profile
- Spring Boot H2 console web-allow-others=true remote access
- Spring Boot YAML H2 console web-allow-others: true
- Spring Boot actuator env show-values=always exposes secrets
- Spring Boot YAML show-values: always unmasks actuator env
- Spring Boot actuator exposure.include=* exposes all endpoints
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.