- Added a bash() network perimeter guard that refuses binding a dev or admin server to a public interface (`0.0.0.0`, `::`, `--host 0.0.0.0`, `HOST=0.0.0.0`, `-p 0.0.0.0:...`) and names the loopback form plus the `RLM_ALLOW_PUBLIC_LISTEN=1` opt-in for a deliberate public bind.
- Added a bash() warning when a command hardcodes a well-known dev port, naming the ephemeral form (`PORT=0` or `--port 0`) instead of refusing the command.