Improper Assets Management in Quarkus occurs when sensitive endpoints, development tools, or internal static resources are exposed beyond their intended scope—typically in production environments. Attackers leverage these 'shadow' assets to map the attack surface, leak configuration details, or access management consoles like Swagger UI or Dev UI that should be restricted to local development.

The Vulnerable Pattern

# application.properties - VULNERABLE CONFIG
# Exposes Swagger UI and Dev UI globally in all environments
quarkus.swagger-ui.always-include=true
quarkus.hibernate-orm.log.sql=true
Serving static resources from the root of META-INF/resources
This often leads to accidental exposure of sensitive build files
quarkus.http.static-resources.index-page=index.html

The Secure Implementation

To mitigate Improper Assets Management, you must enforce build-time profile separation. Use the '%prod' prefix in your 'application.properties' to explicitly disable debugging features and UI consoles. By setting 'quarkus.swagger-ui.always-include' to false in production, you remove a major reconnaissance vector. Additionally, move static assets into a dedicated sub-path rather than the root 'META-INF/resources' to ensure that internal metadata or build artifacts aren't inadvertently served to the public web.

# application.properties - SECURE CONFIG
# Enable Swagger UI only for development and testing
%dev.quarkus.swagger-ui.always-include=true
%test.quarkus.swagger-ui.always-include=true
%prod.quarkus.swagger-ui.always-include=false
Strict profile-based logging
%prod.quarkus.hibernate-orm.log.sql=false
Isolate static assets to a specific subdirectory to prevent path leakage
quarkus.http.static-resources.path=/public
Force-disable Dev Services in production to prevent shadow containers
%prod.quarkus.devservices.enabled=false