self-hosted v0.0.6 Darwin arm64 binds all interfaces; no documented loopback override

Summary

The official self-hosted server-v0.0.6 Darwin arm64 binary listens on all interfaces (*:6768). I found no documented host/bind environment variable or CLI flag that restricts it to loopback.

This reproduces the behavior described in closed #1148. It was verified specifically against v0.0.6; I have not retested the newer 0.0.7 release candidate.

Environment

• macOS on Apple Silicon (Darwin arm64)
• official supermemory-server 0.0.6 release binary
• fresh disposable data directory
• synthetic test data only

Reproduction

SUPERMEMORY_DATA_DIR=/tmp/sm-test PORT=6768 ./supermemory-server
lsof -nP -iTCP:6768 -sTCP:LISTEN

Observed:

supermemory-server ... TCP *:6768 (LISTEN)

The released binary contains a startup path using hostname: "0.0.0.0". I did not find a documented HOST, SUPERMEMORY_HOST, or equivalent bind override.

Expected behavior

Either bind to 127.0.0.1 / ::1 by default with explicit opt-in for LAN exposure, or honor a documented host setting that lets an operator enforce loopback-only binding.

Why this blocks local use

A host firewall rule can compensate, but it requires administrator privileges and is not an adequate default for a local personal-memory service. I stopped the test server after testing.