fix(security): rebuild Config Server deny-by-default on live develop

[seonghobae]

Rebuilds stale Draft #220 from exact protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4 without rewriting its history. Issue #193 remains the security/product owner; #220 is already closed after its unique work was preserved in this replacement.

Valid fail-first proof

Exact test-only RED head 75fc71a35b08f093e37e07bdc25aaa044ee2ea73 added only ConfigServerInboundSecurityTest. CI run 31458262387, macOS job 93676438494, checked out synthetic integration revision d3944f635ee6e36aa7d5b3f7cd5b563107cef765 (Merge 75fc71a... into 942d164...). ETL and CDC completed successfully; the real Config Server then booted on a random port with the native backend and exactly the new boundary assertion failed: anonymous /application/default returned 200 OK instead of required 403 Forbidden. This is valid RED at the intended inbound HTTP boundary, not setup/import/fixture failure. Synthetic-merge evidence remains development evidence rather than literal-source acceptance proof.

Narrow GREEN

Exact current source head 1cd9a0a4cbab85f6674e006fa4c81288f0f8faea is three commits ahead of the unchanged protected base and contains only:

• the fail-first inbound HTTP test;
• the maintained spring-boot-starter-security dependency scoped to config-server;
• ConfigServerSecurityConfiguration, which permits /actuator/health, /actuator/health/**, and /actuator/info, denies every other request, disables accidental Basic/form-login/logout/CSRF surfaces for this credential-free reference posture, and documents why deployment-owned authentication remains a separate decision.

No repository credential, caller-controlled identity header, trust root, issuer, service account, or production authentication mechanism is invented.

Current hosted evidence

All exposed workflow aggregates associated with exact current head 1cd9a0a4cbab85f6674e006fa4c81288f0f8faea are terminal success:

• CI 31460490334 — success;
• Dependency Review 31460490370 — success;
• SBOM 31460490325 — success;
• SAST Semgrep 31460490330 — success;
• Security Scan 31460490401 — success.

Fresh review inventory on this exact head has no formal reviews and no unresolved inline review threads. These aggregates do not authorize merge: the repository still lacks accepted literal-source exact-head/current-base proof, qualifying independent non-author formal approval, and accepted non-vacuous applicable owned-production coverage; skipped/self-hosted or aggregate-only evidence is not passing.

Keep Draft. Issue #193 still owns the production service-identity contract (issuance, rotation/revocation, authorization by application/profile/label, TLS/provenance, degraded behavior and secret-safe observability). Do not weaken the fail-closed reference posture merely to make Config Server usable before that identity contract is selected and proven.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dc407062-45b9-4932-8a4b-aadc403df434

📥 Commits

Reviewing files that changed from the base of the PR and between 942d164 and 1cd9a0a.

📒 Files selected for processing (3)

• config-server/pom.xml
• config-server/src/main/java/com/xtrmetl/config/ConfigServerSecurityConfiguration.java
• config-server/src/test/java/com/xtrmetl/config/ConfigServerInboundSecurityTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.