← fix library

HIGH LM Studio: LM Studio local API reachable without authentication

Why it matters

LM Studio's OpenAI-compatible API is meant for localhost. On the public internet, strangers can list and run your local models on your hardware.

Fix it — 3 steps

  1. Disable network binding in LM Studio (listen on 127.0.0.1 only).
  2. If you need remote access, put an authenticating reverse proxy with TLS in front.
  3. Block the port at the firewall: `sudo ufw deny 1234`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:1234/v1/models  # should time out or refuse from outside

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack