Xander Van Raemdonck 19d2dee5c9 Bind registry proxy to loopback only ... Without an explicit host, `server.listen(0)` binds to every interface, turning safe-chain's unauthenticated forward proxy into an open relay while `aikido-*` commands are running. Anyone reachable on the network can use it to hit the victim's localhost, intranet, or cloud metadata endpoints. The advertised HTTPS_PROXY URL already used `localhost` (loopback), but the listener itself was wide open. Bind to 127.0.0.1 explicitly and update the advertised URL to match. Add a regression test that verifies the listener refuses connections on non-loopback interfaces.		2026-04-30 20:37:41 +02:00
..
safe-chain	Bind registry proxy to loopback only	2026-04-30 20:37:41 +02:00