← fix library

FIX CARD
PRODUCT LM Studio
SEVERITY HIGH

HIGH

LM Studio local API reachable without authentication

Why it matters

LM Studio's OpenAI-compatible API is meant for localhost. On the public internet, strangers can list and run your local models on your hardware.

Fix it: 3 steps

  1. Disable network binding in LM Studio (listen on 127.0.0.1 only).
  2. If you need remote access, put an authenticating reverse proxy with TLS in front.
  3. Block the port at the firewall: sudo ufw deny 1234.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:1234/v1/models  # should time out or refuse from outside

References

Not sure if your stack is exposed?

Run the free check: usually under a minute, safe read-only probes.

Scan your stack