Just reviewed a deployment where the orchestrator's management API was left wide open to the internal network. Default configuration had debug endpoints enabled. This is a classic oversight that hands over system introspection, memory dumps, and sometimes even a shell to anyone who can reach the IP and port.

You'll see this in tools like Kubernetes (the pprof endpoints on the kube-apiserver), HashiCorp Nomad, and various custom orchestration platforms. The debug data is invaluable for developers, but it's a liability in production.

Check your configs. Look for flags like:
```
--enable-debugging-handlers=true
--enable-profiling=true
```
Or environment variables like `DEBUG=1`. Set them to false.

* **Internal != Safe:** Don't rely on network segmentation alone. Defense in depth means turning off what you don't need.
* **Audit Your Services:** Use netstat or `ss` to see what's listening, then check each endpoint's documentation for debug flags.
* **Log the Change:** Your central logging should capture when this config is applied. If you see requests to `/debug/pprof` or `/debug/flag` after that, it's an immediate alert.

This isn't a theoretical vulnerability. I've seen these endpoints used to dump goroutines and find database credentials stored in memory. Turn them off.