You need to secure the Spring Boot Actuator's endpoints because it exposes a lot of information from running the Spring Boot application which can be considered sensitive. Some of Spring Boot endpoints like /shutdown are also dangerous as a rogue user can shut down the production instance resulting in loss of money and reputation.