Is that `--host` listening on non-local addresses? Might be good to default to local-only.

Good call out; in my context yes I do want it listening for use by other machines in its subnets and deliberately set that option (including using the IPv6 form), but most people are probably better off binding to loopback. Thanks