fix(webui): do not expose the Flask debug console on 0.0.0.0 by default

webui/app.py

@@ -704,5 +704,15 @@ def get_model_status():
         print("Tip: You can load Kronos model through /api/load-model endpoint")
     else:
         print("Tip: Will use simulated data for demonstration")
-
-    app.run(debug=True, host='0.0.0.0', port=7070)
+
+    # Defaults chosen for a laptop rather than a server: bind loopback, no
+    # debugger. The previous `host='0.0.0.0', debug=True` published a Flask
+    # debug console -- which executes arbitrary Python through the browser --
+    # to every machine on whatever cafe or office wifi the laptop joins.
+    # Both are still reachable via env var for deliberate use.
+    host = os.environ.get('KRONOS_WEBUI_HOST', '127.0.0.1')
+    port = int(os.environ.get('KRONOS_WEBUI_PORT', '7070'))
+    debug = os.environ.get('KRONOS_WEBUI_DEBUG', '0') == '1'
+    print(f"Serving on http://{host}:{port}")
+
+    app.run(debug=debug, host=host, port=port)

webui/run.py

@@ -79,7 +79,14 @@ def main():
         webbrowser.open('http://localhost:7070')
 
         # Start Flask application
-        app.run(debug=True, host='0.0.0.0', port=7070)
+        # Same env gate as app.py. Upstream hard-codes debug=True + 0.0.0.0
+        # here, and the README lists `python run.py` as the first way to start
+        # -- so the hardening in app.py does nothing for the path most people
+        # actually take, because this file calls app.run itself.
+        host = os.environ.get('KRONOS_WEBUI_HOST', '127.0.0.1')
+        port = int(os.environ.get('KRONOS_WEBUI_PORT', '7070'))
+        debug = os.environ.get('KRONOS_WEBUI_DEBUG', '0') == '1'
+        app.run(debug=debug, host=host, port=port)
 
     except Exception as e:
         print(f"❌ Startup failed: {e}")