Spring Boot DevTools is a development-only tool and should never run in production, since its convenience features carry real performance and security tradeoffs that are unacceptable in a live environment.
Key Points: • DevTools disables certain caching (like template caching) to support live reload, which hurts performance if left on in production. • It can expose additional internal application details that increase the attack surface. • Automatic restarts and extra classloading add memory and CPU overhead not worth paying outside development. • Spring Boot automatically excludes DevTools from a repackaged executable JAR (via spring-boot-maven-plugin), but this should still be verified. • As an extra safeguard, DevTools should be scoped as an optional or provided-only dependency so it can never accidentally ship in a production build artifact.
Example: A team that forgot to verify their build excluded DevTools discovered slower response times and easier introspection into the running app after a production deploy, tracing it back to a dependency scope misconfiguration.
Code Example:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<optional>true</optional>
</dependency>Interview Tip: A concise interview answer is:
"DevTools is strictly a development convenience -- it disables caching for live reload and can expose extra internal detail, both of which are risky in production. Spring Boot excludes it from the repackaged JAR by default, but I still mark it optional/provided and verify the production artifact doesn't include it."