From 01e15de314d076ea9b41e112de9207320cccb741 Mon Sep 17 00:00:00 2001
From: Jeditrix <alexhellings9@gmail.com>
Date: Mon, 26 Jan 2026 22:28:47 +0000
Subject: [PATCH] fix(canvas-host): bind to loopback by default

---
 src/canvas-host/server.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/canvas-host/server.ts b/src/canvas-host/server.ts
index b04d0d5ff..548771360 100644
--- a/src/canvas-host/server.ts
+++ b/src/canvas-host/server.ts
@@ -385,7 +385,7 @@ export async function startCanvasHost(opts: CanvasHostServerOpts): Promise<Canva
     }));
   const ownsHandler = opts.ownsHandler ?? opts.handler === undefined;
 
-  const bindHost = opts.listenHost?.trim() || "0.0.0.0";
+  const bindHost = opts.listenHost?.trim() || "127.0.0.1";
   const server: Server = http.createServer((req, res) => {
     if (String(req.headers.upgrade ?? "").toLowerCase() === "websocket") return;
     void (async () => {