diff --git a/Releases/v2.3/.claude/Observability/apps/server/src/index.ts b/Releases/v2.3/.claude/Observability/apps/server/src/index.ts
index bf52021f94..32167b07a4 100755
--- a/Releases/v2.3/.claude/Observability/apps/server/src/index.ts
+++ b/Releases/v2.3/.claude/Observability/apps/server/src/index.ts
@@ -48,6 +48,11 @@ startTaskWatcher((task: BackgroundTask) => {
 // Create Bun server with HTTP and WebSocket support
 const server = Bun.serve({
   port: 4000,
+  // Bind to loopback only. This server exposes /api/activities
+  // (kitty tab titles) and /api/haiku/summarize (proxied Anthropic API
+  // key) with `Access-Control-Allow-Origin: *` and no authentication —
+  // it must never be reachable from the network.
+  hostname: '127.0.0.1',
   
   async fetch(req: Request) {
     const url = new URL(req.url);