Security

Loopback by default

The Waypoint server binds to IPv4 loopback by default. Annotation data and local JSON persistence remain on the developer machine, and the website never attempts to discover or connect to a visitor’s local server.

Narrow browser boundary

Waypoint exposes no public page-world Annotation CRUD bridge. A narrow read-only probe may assist React Source Identity, but Source Identity is untrusted context rather than guaranteed source mapping.

Host validation, bounded payloads, explicit site permission, and local-only defaults are part of the active boundary rather than optional deployment advice.