Description
The default bind address in src/cfg.rs:8 is 0.0.0.0, which binds the service to all network interfaces. This means the service is accessible from any network the host is connected to, potentially exposing it on public interfaces unintentionally.
While this default makes sense for containerized deployments (as in the Dockerfile), it can be a security concern for direct host deployments.
Severity
Info
Suggested Fix
Consider defaulting to 127.0.0.1 (localhost only) for safer out-of-the-box behavior, or at minimum document the security implications of the default.
Description
The default bind address in
src/cfg.rs:8is0.0.0.0, which binds the service to all network interfaces. This means the service is accessible from any network the host is connected to, potentially exposing it on public interfaces unintentionally.While this default makes sense for containerized deployments (as in the Dockerfile), it can be a security concern for direct host deployments.
Severity
Info
Suggested Fix
Consider defaulting to
127.0.0.1(localhost only) for safer out-of-the-box behavior, or at minimum document the security implications of the default.