2 Commits

Author	SHA1	Message	Date
Xiangzhe	ac206e9375	feat(cli): boot exposure warning for unauthenticated LAN bind (GHSA-wmgv-ph3p-rv57) ... The shipped default (bind 0.0.0.0 + no API-key requirement) is a deliberate, documented local-first posture — but an operator on an untrusted network should learn that at startup, not after a surprise quota bill. serve now prints a loud warning naming both escape hatches (REQUIRE_API_KEY=true or OMNIROUTE_SERVER_HOST=127.0.0.1) whenever the resolved bind is non-loopback and no key is required. Silent on loopback binds and when REQUIRE_API_KEY is enabled. The default posture itself is unchanged (operator decision).	2026-08-23 12:50:42 -03:00
Yahoo	2098ba3848	fix(cli): ignore non-Windows HOSTNAME when binding server (#10557) ... * fix(cli): ignore non-Windows HOSTNAME when binding server * chore(changelog): assign PR number	2026-08-17 08:09:19 -03:00