What is Dev Server Exposure?
Development servers such as Vite, webpack-dev-server, and framework dev modes are built for one trusted user on localhost. Flags like --host bind them to every network interface, and a public tunnel puts them on the internet.
They are not hardened for hostile traffic. CISA lists a Vite vulnerability among known exploited vulnerabilities and notes that only dev servers exposed to the network are affected.
How LayerV Implements This
Keep the dev server on localhost and publish it with the qURL CLI. Recipients reach it through their own link, and by protocol design, requests without a session get no response.