[nkozyra]

Given this is largely talking about sniffing development platforms, it could also require a nonce registered in the app and the frontend and only respond if that's sent via a header.

This would prevent having to worry about people who use other hostnames for host even in localdev.