Fix Improper Assets Management in Cuba

Improper Assets Management in the CUBA Platform (now Jmix) creates a massive attack surface via 'Shadow APIs'—forgotten REST endpoints, legacy service beans, or undocumented entity views. Attackers exploit these to bypass business logic or exfiltrate data through generic API wrappers that developers forgot to decommission or secure.

The Vulnerable Pattern

cuba.rest.genericEnabled = true

The Secure Implementation

To kill Improper Assets Management, you must enforce a strict 'Deny-by-Default' posture. First, disable the Generic REST API (`cuba.rest.genericEnabled = false`) to prevent attackers from querying any entity via `/rest/v2/entities`. Second, audit your `rest-services.xml` and `rest-queries.xml` to ensure only the absolute minimum required methods are exposed. Third, use CUBA's 'REST: Access to services' security roles to ensure that even if a service is exposed, only specific service-account tokens can invoke it. Finally, use the `/rest/v2/docs/swagger.json` endpoint during dev-time to inventory all active assets and prune anything that doesn't belong in production.

# Disable generic entity CRUD if not strictly required
cuba.rest.genericEnabled = false