Does Bun.serve() default to all network interfaces when hostname is omitted?

When implementing a web server using Bun.serve(), the configuration object allows for an optional hostname property to define the network interface the server binds to.

In environments where security requires strict isolation, there is a need to understand the runtime's default binding behavior to prevent accidental public exposure of internal services. If the hostname is not explicitly defined, the server may bind to 0.0.0.0, making the application accessible to any device on the local network or the public internet, depending on the firewall configuration.

What is the default binding address for Bun.serve() in recent versions when no hostname is provided? Does the runtime prioritize the loopback interface or all available interfaces by default?