Will It Vibe?spring-boot-devtools not scoped out of production
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
spring-boot-devtools is declared without Maven's <optional>true</optional> (or, in Gradle, without the developmentOnly/runtimeOnly configuration), so a default packaging can carry devtools onto the production classpath. Devtools enables a live-restart trigger and relaxed caching that are meant for a local dev loop only.
Why it matters
Without Maven's <optional>true</optional> (or Gradle's developmentOnly/runtimeOnly configuration), a default package build can carry spring-boot-devtools onto the production classpath. Devtools enables a live-restart trigger and relaxed caching that are meant for a local development loop, not for a deployed service.
How to fix it
Scope spring-boot-devtools as optional in Maven (<optional>true</optional> inside its <dependency> block) or as developmentOnly in Gradle, exactly as Spring Boot's own documentation recommends, so standard packaging (java -jar, layered Docker builds) excludes it automatically.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo