[wchieng]

Summary

The dev server listened on 0.0.0.0 with no authentication. Anyone on the same network could read and override flags, replace the database via backup restore, or post unbounded SDK events.

// before
addr := fmt.Sprintf("0.0.0.0:%s", serverParams.Port)
// after
addr := net.JoinHostPort(serverParams.Host /* default "127.0.0.1" */, serverParams.Port)

• New persistent flag --host (also LD_HOST / config host). It defaults to 127.0.0.1.
• Behavior change: if you run the dev server in Docker with -p, or reach it from a phone or emulator on the LAN, you now need --host 0.0.0.0. This needs a release note.
• Request body size limits and debug_events retention will come in a separate PR.

Link to Devin session: https://app.devin.ai/sessions/33518e0108ac4ea3aaec26dd594dbd62
Open in Devin Desktop: https://app.devin.ai/desktop/session/33518e0108ac4ea3aaec26dd594dbd62?variant=devin
Requested by: @wchieng

---

Note

Overview
Security-focused behavior change: the dev server no longer binds to all interfaces (0.0.0.0) by default; it listens on 127.0.0.1 unless overridden.

Adds a persistent --host flag (default 127.0.0.1), host in ldcli config, and LD_HOST via viper. The listen address is built with net.JoinHostPort instead of hard-coded 0.0.0.0. When the server starts on loopback/localhost, it logs a hint to pass --host 0.0.0.0 for Docker, LAN, or emulator access. Config help golden and Update tests cover the new setting.

^{Reviewed by Cursor Bugbot for commit ec0da06. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[ld-ahartmann]

@BugBot review

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4109095. Configure here.}