How would you use Actuator diagnostic endpoints during an incident without creating a security risk?

The runbook chooses the least invasive evidence first: metrics and traces, then representative thread dumps, and heap dumps only when memory evidence justifies the privacy and pause risk. Diagnostics are captured from a representative unhealthy instance before restart when safe, while traffic is reduced if collection affects service. I verify redaction and management exposure regularly. Operator actions are correlated with the incident timeline so later analysis can distinguish the original fault from diagnostic side effects.