[ffumero2003]

Context

The example dev servers (browser-uploader, node-presigned-with-auth) call server.listen(PORT) with no host argument, so Node binds to all interfaces (0.0.0.0) even though they log http://localhost. These are local-only developer demos and should stay on the loopback interface.

Changes

• Bind both example servers explicitly to 127.0.0.1 (loopback).
• Add a short note that any real deployment must bind appropriately and serve over HTTPS.

Verification

• pnpm typecheck:examples, pnpm typecheck, pnpm lint, pnpm build — all pass.
• pnpm verify — 2,621 tests passed, 9 skipped.
• Diff limited to the two example server files.

Closes #379

[ffumero2003]

Closing — per our security process a medium finding is reviewed on the private mirror first, then lands here as a neutral squash-merge PR. Moved to the private mirror (review PR); a neutral public PR will follow once approved.