failproofai Dashboard Binds to 0.0.0.0 by Default, Exposing Claude Sessions to LAN Without Authentication

A default configuration in failproofai's dashboard exposes sensitive Claude session data to anyone on the same local network—without requiring authentication. The dashboard binds to 0.0.0.0, listening on all network interfaces, which means on shared networks such as coffee shops, hotels, or corporate Wi-Fi, anyone who can reach the user's IP address on port 8020 can browse directly to /projects and read complete project folders, full JSONL session transcripts containing every prompt, tool call, file path, and code snippet, along with policy configurations.

The exposure stems from scripts/launch.ts, which unconditionally sets HOSTNAME=0.0.0.0 before spawning Node's standalone server. The proposed security enhancement would switch the default binding to 127.0.0.1 (loopback only) and add an explicit --host opt-in flag for users who intentionally want LAN exposure. This would preserve the local-first experience for most users while eliminating a default-on network exposure that many may not realize exists.

For developers using failproofai with Claude on sensitive codebases, proprietary projects, or confidential data, the risk is significant. Session transcripts can reveal not just code but reasoning patterns, API integrations, internal tooling, and business logic. Until a patch is implemented, users on untrusted networks should be aware that their Claude sessions could be visible to others on the same LAN segment. The issue highlights a common tension in developer tooling: defaults that prioritize convenience over security boundaries, potentially exposing sensitive workflows to network-level access that users rarely anticipate.