Hardhat node RPC exposed on all interfaces when using --hostname 0.0.0.0 without warning

Goal

Determine whether Hardhat should provide a safety mechanism that alerts users when the RPC server is bound to all network interfaces (0.0.0.0) to prevent accidental public exposure of the node.

Constraints and uncertainty

Hardhat’s default binding is 127.0.0.1:8545, but specifying the --hostname 0.0.0.0 flag changes the listener to all interfaces without emitting a warning. Changing the default behavior or adding warnings could affect existing scripts, CI pipelines, and tutorials that rely on the current flag usage. The project maintainers have not yet decided on introducing a warning, a configuration option to enforce localhost‑only binding, or altering the default to require an explicit opt‑in for public exposure.

• Should the Hardhat CLI emit a warning when --hostname 0.0.0.0 is used?
• Is there a need for a configurable option in hardhat.config.js to enforce localhost‑only binding across all scripts?
• Should the default binding be changed to require an explicit opt‑in for public RPC access?