DefaultServeMux with net/http/pprof and expvar: accidental public exposure of debug endpoints
When a Go program imports net/http/pprof or expvar, the standard library registers /debug/pprof/* and /debug/vars handlers on http.DefaultServeMux during package initialization. If the public HTTP server also binds to http.DefaultServeMux and listens on 0.0.0.0, those debug endpoints become reachable by any external client, creating an unintended exposure su