anchor.diff:  [[production-ready-auditing]]
   == Auditing
   Once Spring Security is in play Spring Boot Actuator has a flexible audit framework that
  -publishes events (by default, '`authentication success`', '`failure`' and '`access denied`'
  -exceptions). This feature can be very useful for reporting and for implementing a
  -lock-out policy based on authentication failures. To customize published security events,
  -you can provide your own implementations of `AbstractAuthenticationAuditListener` and
  -`AbstractAuthorizationAuditListener`.
  -
  -You can also use the audit services for your own business events. To do so,
  -either inject the existing `AuditEventRepository` into your own components and
  -use that directly or publish an `AuditApplicationEvent` with the Spring
  -`ApplicationEventPublisher` (by implementing `ApplicationEventPublisherAware`).
  +publishes events (by default, '`authentication success`', '`failure`' and
  +'`access denied`' exceptions). This feature can be very useful for reporting and for
  +implementing a lock-out policy based on authentication failures. To customize published
  +security events, you can provide your own implementations of
  +`AbstractAuthenticationAuditListener` and `AbstractAuthorizationAuditListener`.
  +
  +You can also use the audit services for your own business events. To do so, either inject
  +the existing `AuditEventRepository` into your own components and use that directly or
  +publish an `AuditApplicationEvent` with the Spring `ApplicationEventPublisher` (by
  +implementing `ApplicationEventPublisherAware`).
   
   
   
  
positive.code: HTTP traffic. Take care not to accidentally expose sensitive information if you change
  the `management.security.enabled` property.
  
  If you deploy applications publicly, you may want to add '`Spring Security`' to
  handle user authentication. When '`Spring Security`' is added, by default, '`basic`'
  authentication is used. The username is`user` and the password is a random generated
  password (which is printed on the console when the application starts).
  
  TIP: Generated passwords are logged as the application starts. To find the password in
  the console, search for '`Using default security password`'.
  
  You can use Spring properties to change the username and password and to change the
  security role(s) required to access the endpoints. For example, you might set the following
  properties in your `application.properties`:
  
  [source,properties,indent=0]
  ----
  
negative.code: 
  [[production-ready-application-info-git]]
  ==== Git Commit Information
  Another useful feature of the `info` endpoint is its ability to publish information about
  the state of your `git` source code repository when the project was built. If a
  `GitProperties` bean is available, the `git.branch`, `git.commit.id` and `git.commit.time`
  properties are exposed.
  
  TIP: A `GitProperties` bean is auto-configured if a `git.properties` file is available at
  the root of the classpath. See
  "<<howto.adoc#howto-git-info,Generate git information>>" for more details.
  
  If you want to display the full git information (that is, the full content of
  