OmniRoute/changelog.d/fixes/9286-redis-loopback-bind.md

• fix(docker): the bundled Redis sidecar no longer publishes on 0.0.0.0. docker-compose.yml, omniroute redis up and the dashboard's 1-click launcher all built an unqualified -p <port>:6379 spec, which the container runtime expands to every interface — and none of them sets requirepass, so any host on the LAN could reach the rate-limiter/cache store. All three now default to 127.0.0.1, with exposure opt-in via REDIS_BIND_HOST (compose), --bind (CLI) and OMNIROUTE_REDIS_BIND_HOST (launcher); the CLI warns when a non-loopback bind is requested without --password (#9286)