Skip to content

Docs: Add security warning for --host 0.0.0.0 in CLI options - #35241

Merged
jonniebigodes merged 6 commits into
nextfrom
copilot/documentation-fix-host-flag-security
Jun 30, 2026
Merged

jonniebigodes merged 6 commits into
nextfrom
copilot/documentation-fix-host-flag-security

Conversation

Copilot AI commented Jun 20, 2026 •

Copy link
Copy Markdown
Contributor

The --host CLI flag docs gave no indication that binding to 0.0.0.0 exposes Storybook to all network interfaces, or that core.allowedHosts exists to mitigate this. The runtime warning in build-dev.ts already covers this at runtime, but users reading the docs had no way to know.

Changes

  • docs/api/cli-options.mdx: Expanded the --host flag description to note that 0.0.0.0 binds to all interfaces and links to core.allowedHosts for restricting access.

Manual testing

None needed.

Summary by CodeRabbit

  • Documentation
    • Reformatted multiple CLI “Options include” sections in the API docs into consistent pipe-delimited Markdown tables for improved readability.
    • Updated storybook dev --host [string] documentation to clarify that 0.0.0.0 binds to all network interfaces and added a reference to host-access security configuration.

Co-authored-by: ghengeveld <321738+ghengeveld@users.noreply.github.com>
Copilot AI changed the title [WIP] Update documentation for --host flag security risks Docs: Add security warning for --host 0.0.0.0 in CLI options Jun 20, 2026
Copilot AI requested a review from ghengeveld June 20, 2026 19:48
@ghengeveld
ghengeveld marked this pull request as ready for review June 20, 2026 20:55
@ghengeveld ghengeveld added documentation ci:docs Run the CI jobs for documentation checks only. qa:skip Pull Requests that do not need any QA. (e.g. documentation) labels Jun 20, 2026
@coderabbitai

coderabbitai Bot commented Jun 20, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The storybook dev --host [string] option documentation is expanded to note that setting the value to 0.0.0.0 binds to all network interfaces and directs readers to core.allowedHosts for host access restriction. All CLI command option tables across the document are reformatted to a consistent two-column pipe-delimited Markdown table structure with standardized headers and separators.

Changes

CLI Options Documentation

Layer / File(s) Summary
storybook dev --host option: 0.0.0.0 binding and allowedHosts documentation
docs/api/cli-options.mdx
The --host [string] table entry is expanded to describe 0.0.0.0 binding behavior and link to core.allowedHosts for access control; storybook dev options table is reformatted to consistent Markdown structure.
CLI option tables: consistent Markdown structure across all commands
docs/api/cli-options.mdx
Option tables for build, init, add, remove, upgrade, migrate, automigrate, doctor, ai, ai setup, index, sandbox, and create-storybook commands are reformatted to consistent two-column pipe-delimited Markdown table layout; option content remains unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related issues


Comment @coderabbitai help to get the list of available commands and usage tips.

@jonniebigodes jonniebigodes left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ghengeveld thanks for taking the time to make this pull request and adjusting the docs with this important caveat. Appreciate it 🙏 . I've checked it and left a small item for you to look into when you can.

Approving to unblock you.

Comment thread docs/api/cli-options.mdx Outdated
Co-authored-by: jonniebigodes <joaocontadesenvolvimento@gmail.com>
@ghengeveld

Copy link
Copy Markdown
Member

@copilot fix markdown table formatting

Co-authored-by: ghengeveld <321738+ghengeveld@users.noreply.github.com>

Copilot AI commented Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

@copilot fix markdown table formatting

Done in 7f8e978. Removed trailing spaces from all description column cells throughout the file so the table formatting is consistent — no row is wider than the others.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/api/cli-options.mdx`:
- Line 177: The CLI example in the `--package-manager` row is missing a space
between `[addon]` and `--package-manager` flag, making the command `storybook
remove [addon]--package-manager pnpm` invalid. Add a space before
`--package-manager` so the example reads `storybook remove [addon]
--package-manager pnpm` to make it a valid copy-pasteable command.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 05747507-1d44-405e-8210-70b41d41cbe5

📥 Commits

Reviewing files that changed from the base of the PR and between 32793d3 and 0c084f6.

📒 Files selected for processing (1)
  • docs/api/cli-options.mdx

Comment thread docs/api/cli-options.mdx Outdated
@jonniebigodes
jonniebigodes merged commit 2734397 into next Jun 30, 2026
18 checks passed
@jonniebigodes
jonniebigodes deleted the copilot/documentation-fix-host-flag-security branch June 30, 2026 15:44
@github-actions github-actions Bot mentioned this pull request Jun 30, 2026
2 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci:docs Run the CI jobs for documentation checks only. documentation qa:skip Pull Requests that do not need any QA. (e.g. documentation)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants