An API has a 'health check' endpoint at GET /api/health that returns server version, database connection status, and uptime. This endpoint is publicly accessible without authentication. What security issue does this create?

• A.Verbose health endpoints expose the debug console: a probe to /api/health can run commands on the host (the framework's actuator mode), and attackers use that access to pivot into the CI runner. Health checks should sit behind HTTP Basic auth, with credentials shared across all monitoring tools
• B.Detailed health endpoints leak sensitive system information: server version (CVE lookup), database type and status (confirms backend technology for targeted attacks), internal service topology, and uptime (reveals deployment patterns). Health checks should return minimal information publicly (e.g., HTTP 200/503 only) and provide detailed status only to authenticated monitoring systems
• C.Public health endpoints enable a denial of service: each call runs a full database query (a connection pool check), and attackers use the probe to exhaust connections. Health checks should be cached for one hour at the CDN, with the status refreshed by all clients through a long-lived WebSocket