An API has a 'health check' endpoint at GET /api/health that returns server version, database connection status, and uptime. This endpoint is publicly accessible without authentication. What security issue does this create?

• A.Health check endpoints are always safe to expose publicly
• B.Unauthenticated health endpoints are required by Kubernetes liveness probes
• C.Health checks should only use GET and not return any HTTP status codes
• D.Detailed health endpoints leak sensitive system information: server version (CVE lookup), database type and status (confirms backend technology for targeted attacks), internal service topology, and uptime (reveals deployment patterns). Health checks should return minimal information publicly (e.g., HTTP 200/503 only) and provide detailed status only to authenticated monitoring systems