Is your dev server listening on all network interfaces?

Check which address your dev server binds to. Vite's default is localhost, but setting the host to 0.0.0.0 or true makes it listen on all addresses, including LAN and public ones. Anyone who can reach your machine can then request your source code, so expose it only when you must.

Localhost versus all interfaces

Vite's documentation describes server.host as specifying which IP addresses the server should listen on, defaulting to localhost, and describes 0.0.0.0 or true as listening on all addresses, "including LAN and public addresses". Other frameworks have similar flags, so find yours.

Why developers open it up

Common reasons are testing on a phone, showing a colleague, or running inside a container or WSL where localhost behaves differently. The Vite page notes that on WSL2, setting host to true is not enough to reach the server from your LAN, so people try more settings. Each extra step widens exposure, so stop at the narrowest one that works.

The two settings that matter next

The Vite docs warn about two options:

• allowedHosts: by default localhost, .localhost domains and IP addresses are allowed. Setting it to true "allows any website to send requests to your dev server through DNS rebinding attacks". Use an explicit list.
• cors: setting it to true allows any website to send requests to the dev server, which the documentation says can expose your source code and content. Use an explicit list of origins.

A dev server is not built for hostile networks. It often serves source maps, environment values compiled into the bundle and unminified code.

Steps to check

1. Start the server and look at the address it prints.
2. On macOS or Linux, run lsof -iTCP -sTCP:LISTEN -P and look for your port. On Windows, use netstat -an.
3. If you see 0.0.0.0 or * against the port, ask whether you meant that.
4. Prefer an explicit host or a tunnel with access control over opening to all interfaces.
5. Never open a dev server on public Wi-Fi.
6. Keep real secrets out of client bundles. A value compiled into frontend code is public to whoever can load the page.

For the same discipline on container sockets, see mounting the Docker socket is root on the host.

Safeguard's DAST and API scans work against a running web app, so a dev or staging instance can be tested before release. Try a free scan at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at what a scan can find on a running web app that code review alone would not.

Quick check

Sources

• Vite: server options

Last reviewed: 19 October 2026.