Spring Boot Security Scan

Defensive scan for Spring Boot 3.x with Spring Security 6.x. Reports findings using the shared scoring schema.

Scope

• *Application.java and @Configuration classes
• SecurityFilterChain beans / WebSecurityConfigurerAdapter (legacy)
• @RestController / @Controller classes
• application.{properties,yml}
• Repositories / DAOs using JdbcTemplate, EntityManager, native queries

Procedure

1. Locate every SecurityFilterChain bean and read the request-matcher rules in order — first match wins.
2. Walk controller methods for @PreAuthorize / @Secured / endpoint-level rules.
3. Inspect data-access layer for native queries built by string concat.
4. Inspect application.{properties,yml} for secrets and actuator exposure.