Is your dev server open to everyone on the Wi-Fi?

Check what’s open right now

lsof -nP -iTCP -sTCP:LISTEN | awk 'NR==1 || $9 ~ /^\*:/'

This prints only the listeners bound to every interface. Read the NAME column:

Address	Reachable from
127.0.0.1:3000, [::1]:3000, localhost:3000	This Mac only
*:3000 (or 0.0.0.0:3000)	Any device that can reach your Mac
192.168.1.24:3000	Devices on that one network

You’ll usually see some system entries too, such as ControlCenter (AirPlay) or rapportd. Those are Apple services. Focus on node, python, ruby, java, com.docker.backend and friends.

To prove it, find your LAN address and request the server through it:

ipconfig getifaddr en0
curl -I http://$(ipconfig getifaddr en0):3000

If that returns HTTP headers, so would a stranger’s laptop on the same network. A server bound to 127.0.0.1 refuses the connection.

Why it matters

Dev servers aren’t built for the open internet. They often run with debug pages that print stack traces and environment variables, admin panels with seeded passwords, API routes with no auth, and source maps for your whole codebase. On home Wi-Fi the risk is small. On a shared network, anyone running a port scan finds :3000 in seconds.

Bind each framework to localhost

Several tools are already private by default. The table shows the default and the flag that changes it.

Tool	Default	Stay local	Opens it up
Vite, SvelteKit, Astro	localhost	(default)	--host
Next.js next dev	all interfaces	next dev -H 127.0.0.1	(default)
Nuxt nuxi dev	localhost	(default)	--host
Angular ng serve	localhost	(default)	--host 0.0.0.0
Express / plain Node	all interfaces	app.listen(3000, '127.0.0.1')	app.listen(3000)
Rails (development)	localhost	(default)	-b 0.0.0.0
Django runserver	127.0.0.1	(default)	0.0.0.0:8000
Flask flask run	127.0.0.1	(default)	--host=0.0.0.0
python3 -m http.server	all interfaces	--bind 127.0.0.1	(default)
Docker -p 3000:3000	all interfaces	-p 127.0.0.1:3000:3000	(default)

Two common traps:

• Next.js and Express listen everywhere unless you say otherwise. For Next.js, change your script to "dev": "next dev -H 127.0.0.1".
• --host left in package.json. Someone added it once to test on a phone and it stayed. Check "dev" scripts in package.json and server.host in vite.config.ts.

For Docker Compose, write the host IP in the ports list:

ports:
  - "127.0.0.1:5432:5432"

Turn on the macOS firewall

The application firewall blocks incoming connections per app. Open System Settings › Network › Firewall and switch it on. Then:

• Click Options… to see which apps are allowed. Remove or block entries for node, python3 or ruby you don’t need reachable.
• Block all incoming connections is the strongest setting for travel. It still allows basic services like DHCP and Bonjour, and your local localhost traffic is unaffected.
• Enable stealth mode stops your Mac answering pings and probes on closed ports.

When a new binary first listens on the network, macOS asks “Do you want the application ‘node’ to accept incoming network connections?” Deny it unless you’re deliberately testing from another device. Note that the prompt is tied to the binary, so a new Node version from nvm or Homebrew can ask again.

The firewall is a safety net, not a fix. Binding to localhost means there’s nothing to block.

When you do want LAN access

Testing on a real phone is the usual reason. Do it on purpose: start with --host, check the QR code or URL, and stop the server when you’re done. On a network you don’t control, use a tunnel with access control rather than opening a port.

Seeing it live

Stat Space flags any listening server bound to 0.0.0.0 instead of 127.0.0.1 with a warning on its row in the Ports tab, and the menu bar attention dot lights up so you notice before someone else does. When you do want phone access, the row shows a QR code for the LAN URL. Warnings you’ve decided are fine can be muted per process and port. See the Ports feature for the rest.