fsaunpack/testserver.mjs listens on every interface and serves a recorded archive (with CDN tokens) to the LAN #259

Severity: medium

Where: fsaunpack/testserver.mjs (app.listen(port, () => {...}) with no host, so Express binds all interfaces, with Access-Control-Allow-Origin: * on every file), tools/verify-fsaunpack.mjs (spawns it the same way during pnpm run verify)

What happens

The archive it serves is a user's "dump buffer" recording of a private stream (manifests with CDN tokens in *.txt, media in *.bin), by the recorded URL paths. A developer running node testserver.mjs on a laptop on a shared network exposes the recorded stream and its tokens to anyone on it at http://<laptop>:3000/<recorded path>. Every other test server in the repository binds 127.0.0.1 explicitly.

Suggested fix

app.listen(port, '127.0.0.1', ...) (or process.env.HOST || '127.0.0.1'), and have verify-fsaunpack assert the address it probes is loopback.

Confidence: high.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code