From c275b452be30cf4f936faf6e05a05d309b6ab5e7 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 14 Feb 2026 13:52:27 +0000 Subject: [PATCH] security: bind dashboard server to 127.0.0.1 Explicitly bind the dashboard server to the local loopback interface to prevent external access. This addresses a vulnerability where the server was binding to all network interfaces by default. Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com> --- .../learnings/2026-02-14-secure-dashboard-binding.md | 7 +++++++ src/lib.mjs | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md diff --git a/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md b/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md new file mode 100644 index 0000000..3ef6d4f --- /dev/null +++ b/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md @@ -0,0 +1,7 @@ +# Secure Dashboard Binding + +- **Context:** Hardening the local dashboard server. +- **Observation:** Default `server.listen(port)` in Node.js binds to all interfaces (`0.0.0.0`), exposing the tool to the local network. +- **Action taken:** Explicitly added `'127.0.0.1'` as the hostname argument to `server.listen`. +- **Validation performed:** Verified code change with `grep`. +- **Recommendation for next agents:** Always specify `'127.0.0.1'` for servers intended only for local use. diff --git a/src/lib.mjs b/src/lib.mjs index d36b5d8..6836757 100644 --- a/src/lib.mjs +++ b/src/lib.mjs @@ -547,7 +547,7 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT) { fs.createReadStream(filePath).pipe(res); }); - server.listen(port, () => { + server.listen(port, '127.0.0.1', () => { console.log(`Dashboard running at http://localhost:${port}/dashboard/`); console.log(`Serving files from ${packageRoot}`); console.log(`Using configuration from ${process.cwd()}`);