Summary
The official self-hosted server-v0.0.6 Darwin arm64 binary listens on all interfaces (*:6768). I found no documented host/bind environment variable or CLI flag that restricts it to loopback.
This reproduces the behavior described in closed #1148. It was verified specifically against v0.0.6; I have not retested the newer 0.0.7 release candidate.
Environment
- macOS on Apple Silicon (Darwin arm64)
- official
supermemory-server 0.0.6 release binary
- fresh disposable data directory
- synthetic test data only
Reproduction
SUPERMEMORY_DATA_DIR=/tmp/sm-test PORT=6768 ./supermemory-server
lsof -nP -iTCP:6768 -sTCP:LISTEN
Observed:
supermemory-server ... TCP *:6768 (LISTEN)
The released binary contains a startup path using hostname: "0.0.0.0". I did not find a documented HOST, SUPERMEMORY_HOST, or equivalent bind override.
Expected behavior
Either bind to 127.0.0.1 / ::1 by default with explicit opt-in for LAN exposure, or honor a documented host setting that lets an operator enforce loopback-only binding.
Why this blocks local use
A host firewall rule can compensate, but it requires administrator privileges and is not an adequate default for a local personal-memory service. I stopped the test server after testing.
Summary
The official self-hosted
server-v0.0.6Darwin arm64 binary listens on all interfaces (*:6768). I found no documented host/bind environment variable or CLI flag that restricts it to loopback.This reproduces the behavior described in closed #1148. It was verified specifically against v0.0.6; I have not retested the newer 0.0.7 release candidate.
Environment
supermemory-server 0.0.6release binaryReproduction
Observed:
The released binary contains a startup path using
hostname: "0.0.0.0". I did not find a documentedHOST,SUPERMEMORY_HOST, or equivalent bind override.Expected behavior
Either bind to
127.0.0.1/::1by default with explicit opt-in for LAN exposure, or honor a documented host setting that lets an operator enforce loopback-only binding.Why this blocks local use
A host firewall rule can compensate, but it requires administrator privileges and is not an adequate default for a local personal-memory service. I stopped the test server after testing.