• Remove dev-only endpoints: /debug, test utilities, seed endpoints, and any handler that exists only for development must be disabled or removed in production builds. Feature flags or environment checks are acceptable but deployment validation must verify they’re off.

• Protect actuator/management endpoints: Spring Boot Actuator, Laravel Telescope, Rails /rails/info, Node.js /metrics — all should require strong authentication in production. Limit exposed sub-endpoints to only what ops teams actually need (usually /health and /metrics only).

• Admin dashboards: Never expose admin UIs (Kubernetes dashboard, database admin panels, monitoring consoles) directly to the internet. Place behind a VPN or require authentication before the UI is accessible. Kubernetes: disable the dashboard or deploy it on a port not exposed externally.

• IP restriction: Admin and management endpoints should accept connections only from known internal IPs or VPN subnets. At the network layer, not just in application code — a misconfigured application can still bypass application-layer IP checks, but a firewall rule cannot.

The Kubernetes dashboard was a legitimate operational tool that was deployed without authentication and exposed to the internet — a config decision, not a code bug. The fix is either: (a) add authentication before deployment, or (b) don’t expose it externally at all. Kubernetes dashboard on a non-routable internal port with VPN access is not a vulnerability.