diff --git a/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md b/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md
new file mode 100644
index 0000000..3ef6d4f
--- /dev/null
+++ b/docs/agent-handoffs/learnings/2026-02-14-secure-dashboard-binding.md
@@ -0,0 +1,7 @@
+# Secure Dashboard Binding
+
+- **Context:** Hardening the local dashboard server.
+- **Observation:** Default `server.listen(port)` in Node.js binds to all interfaces (`0.0.0.0`), exposing the tool to the local network.
+- **Action taken:** Explicitly added `'127.0.0.1'` as the hostname argument to `server.listen`.
+- **Validation performed:** Verified code change with `grep`.
+- **Recommendation for next agents:** Always specify `'127.0.0.1'` for servers intended only for local use.
diff --git a/src/lib.mjs b/src/lib.mjs
index d36b5d8..6836757 100644
--- a/src/lib.mjs
+++ b/src/lib.mjs
@@ -547,7 +547,7 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT) {
     fs.createReadStream(filePath).pipe(res);
   });
 
-  server.listen(port, () => {
+  server.listen(port, '127.0.0.1', () => {
     console.log(`Dashboard running at http://localhost:${port}/dashboard/`);
     console.log(`Serving files from ${packageRoot}`);
     console.log(`Using configuration from ${process.cwd()}`);