mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-24 16:12:23 +03:00
ac206e9375
The shipped default (bind 0.0.0.0 + no API-key requirement) is a deliberate, documented local-first posture — but an operator on an untrusted network should learn that at startup, not after a surprise quota bill. serve now prints a loud warning naming both escape hatches (REQUIRE_API_KEY=true or OMNIROUTE_SERVER_HOST=127.0.0.1) whenever the resolved bind is non-loopback and no key is required. Silent on loopback binds and when REQUIRE_API_KEY is enabled. The default posture itself is unchanged (operator decision).