Is that `--host` listening on non-local addresses? Might be good to default to local-only.