[Security] Project proxy task listens on 0.0.0.0 without requiring authentication

[runyuan-wang]

At commit 78a8f98b1f1b4fdd2d875a058f52896cb588f8cf, the project's litellm-proxy task starts LiteLLM with --host 0.0.0.0 --port 4000, while the provided litellm_config.yaml does not configure general_settings.master_key.

With LITELLM_MASTER_KEY unset, an unauthenticated request to /v1/models returns 200 OK. Because the server listens on all interfaces, the gateway may be reachable from other hosts whenever port 4000 is exposed.

Relevant files:

• pyproject.toml
• litellm_config.yaml

Steps to reproduce

1. Ensure that LITELLM_MASTER_KEY is unset.

2. Enter the kernel directory:

   cd ArbiterOS-Kernel

3. Run the command used by the project's litellm-proxy task:

   uv run litellm --config litellm_config.yaml --host 0.0.0.0 --port 4000 --run_hypercorn

4. From another shell, make a request without an Authorization header:

   curl -i http://127.0.0.1:4000/v1/models

Actual behavior

The endpoint returns HTTP 200 and the configured model list without requiring authentication.

I reproduced this locally using the repository lockfile, which resolves LiteLLM 1.81.7.

Expected behavior

The project should either:

• bind to 127.0.0.1 by default; or
• require authentication, or display a prominent warning, when binding to a non-loopback address.

Impact

If upstream provider credentials are configured and port 4000 is reachable over the network, unauthorized clients may submit requests through the proxy and consume provider quota or incur costs.

Suggested fix

• Bind the default local task to 127.0.0.1.
• Require or validate a proxy master key for non-loopback bindings.
• Add an integration test covering unauthenticated requests.
• Document the authentication and network-exposure requirements.