security: bind to loopback by default (app, dev server, Prisma Studio)

EDUCATORS.md

@@ -160,7 +160,7 @@ Designed to complement a web security or application security course over 6–10
 
 Designed for competitive CTF events with 10–30 participants.
 
-**Setup:** Each participant runs their own instance. Flag capture is stored per instance, not per user, so a shared instance would let the first solve reveal the flag to everyone — see the [Deployment FAQ](#can-multiple-students-share-one-instance).
+**Setup:** Each participant runs their own instance on their own machine. `npm start` binds `127.0.0.1`, so no instance is reachable from the event network. Flag capture is stored per instance, not per user, so a shared instance would let the first solve reveal the flag to everyone — see the [Deployment FAQ](#can-multiple-students-share-one-instance).
 
 ```bash
 npx create-oss-store my-lab && cd my-lab && npm start
@@ -222,6 +222,8 @@ docker compose down -v && docker compose up -d   # Wipes all data and restarts f
 
 **No.** OopsSec Store must only be run in isolated environments (local machine or air-gapped VM). It contains intentional security flaws and must never be exposed to a production network or the internet.
 
+Both setups stay on loopback by default: `npm start` listens on `127.0.0.1`, and the documented Docker commands publish on `127.0.0.1:3000`. Reaching the lab from another machine takes a deliberate change.
+
 Recommended setup for classrooms: each student runs the app on their own machine via `localhost`. No shared network exposure needed.
 
 ### What are the system requirements?

SECURITY.md

@@ -102,7 +102,7 @@ You will be told which way the triage went, including when a report is judged ou
 
 The application has no authentication worth the name and is meant to be broken. Treat it as hostile software:
 
-- Run it on `localhost` or an isolated VM. The documented commands bind to loopback (`-p 127.0.0.1:3000:3000`) — keep it that way.
+- Run it on `localhost` or an isolated VM. The documented commands stay on loopback (`npm start` binds `127.0.0.1`, Docker publishes `-p 127.0.0.1:3000:3000`) — keep it that way.
 - Never expose it to the internet, a company network, or a shared school network. See the [Educator Kit deployment FAQ](EDUCATORS.md#deployment-faq).
 - Never seed it with real data, real credentials, or credentials reused elsewhere.
 - Give each player their own instance: progress is stored per instance, so a shared one leaks solves.

docker-entrypoint.sh

@@ -21,4 +21,5 @@ echo "★ Enjoying the lab? A star helps others find it:"
 echo "  https://github.com/kOaDT/oss-oopssec-store"
 echo ""
 
-exec npm start
+# The published port reaches the container on its bridge IP, not on loopback.
+exec npm run start:network

package.json

@@ -1,7 +1,7 @@
 {
   "name": "oss-oopssec-store",
   "author": "kOaDT",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "private": false,
   "license": "MIT",
   "repository": {
@@ -22,9 +22,10 @@
   ],
   "description": "OSS – OopsSec Store, a vulnerable e-commerce for modern web security training.",
   "scripts": {
-    "dev": "next dev --turbopack",
+    "dev": "next dev --turbopack -H 127.0.0.1",
     "build": "next build",
-    "start": "next start",
+    "start": "next start -H 127.0.0.1",
+    "start:network": "next start -H 0.0.0.0",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write .",

packages/create-oss-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-oss-store",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "type": "module",
   "description": "Create a new OSS – OopsSec Store instance for web security CTF training",
   "author": "kOaDT",

scripts/setup.sh

@@ -51,7 +51,7 @@ echo "  https://github.com/kOaDT/oss-oopssec-store"
 echo ""
 
 echo "Launching Prisma Studio and application..."
-npx prisma studio -b none &
+npx prisma studio -b none --hostname 127.0.0.1 --port 5555 &
 PRISMA_PID=$!
 
 npm start &