Description

The SMS adapter (gateway/platforms/sms.py:107) binds to 0.0.0.0:

site = web.TCPSite(self._runner, "0.0.0.0", self._webhook_port)

The Webhook adapter (gateway/platforms/webhook.py:54) also defaults to 0.0.0.0:

DEFAULT_HOST = "0.0.0.0"

This exposes these services to the local network (and internet if port-forwarded).

Expected Behavior

Both should default to 127.0.0.1 (localhost only). Users who need network exposure should explicitly set host: "0.0.0.0" in their platform config.

The API server adapter already does this correctly:

DEFAULT_HOST = "127.0.0.1"  # api_server.py:45

Suggested Fix

• sms.py: Change "0.0.0.0" to config.extra.get("host", "127.0.0.1")
• webhook.py: Change DEFAULT_HOST = "0.0.0.0" to DEFAULT_HOST = "127.0.0.1"

Version

v0.6.0 (v2026.3.30)