task_showcase: default bind 0.0.0.0 contradicts the documented 127.0.0.1:5005

assets/task_showcase/app.py:248-260 と assets/task_showcase/README.md の Run セクションから始めます。現在のデフォルトの bind とドキュメントに記載された URL を確認し、次に python app.py を実行して、デフォルトが loopback である一方、--host 0.0.0.0 は引き続き明示的なオプションであることを確認します。そのオプションについて README を更新してください。

assets/task_showcase/app.py defaults its Flask bind to 0.0.0.0 while the README next to it documents python app.py as serving http://127.0.0.1:5005. The app is a read-only, unauthenticated renderer over local run artifacts, so the default quietly puts those artifacts (task definitions, reports, screenshots) on the LAN instead of loopback.

Current code (main)

assets/task_showcase/app.py:248-260:

parser.add_argument("--host", default="0.0.0.0")
parser.add_argument("--port", type=int, default=5005)
...
app.run(host=args.host, port=args.port, debug=args.debug)

assets/task_showcase/README.md Run section:

pip install flask
python app.py            # serves http://127.0.0.1:5005

The two disagree: following the README's plain python app.py binds all interfaces. Anyone on the same network can read the served tasks/reports; there is no auth on any route (fine for loopback, surprising for 0.0.0.0). Windows Firewall will typically prompt on first run, but a prompt accepted once (or a Linux host with no host firewall) leaves it exposed.

Suggested fix

Default --host to 127.0.0.1, matching the README; keep --host 0.0.0.0 as the explicit opt-in for users who do want to share the dashboard on their network, and mention that flag in the README's Run section. One-line change plus a doc line.