The local HTTP API is bound to 127.0.0.1, so only software on the same Mac can reach it. Anything self hosted elsewhere cannot.
A setting to bind to the LAN, or to accept an authenticated connection from a specific host, would let a self hosted automation platform drive Vowen directly. The bearer token in cli/server.json is already the right mechanism, it just is not reachable from anywhere else.
Defaulting to loopback is the correct and safe choice. This is a request for an opt-in, off by default.
