Is it safe to ship WireDoctor to production?

[ddsha441981]

If the dependency ends up in our production artifact, what does it expose and how do I turn it off?

[ddsha441981]

There's a production kill-switch:

# application-prod.properties
wiredoctor.enabled=false

false completely disables the analyzer — no analysis, no reports, no bean-structure exposure. Set it in your prod profile if the dependency ships in the production artifact.

On what's exposed when it IS enabled:

• The reports contain your bean names, dependency graph, and startup timings — internal architecture info. Don't serve wiredoctor-report.html/.json publicly, and treat /actuator/wiredoctor/* like any other sensitive actuator endpoint (secure it the same way you secure /actuator/beans).
• Network behavior: zero. WireDoctor's JVM does no network I/O — reports render fully offline, no telemetry, no dashboard server.

Details: security posture guide. Recommended pattern: enabled in dev/staging/CI (that's where the gates and reports earn their keep), killed in prod.