uWSGI stats server binding to 0.0.0.0 when address is explicitly specified

uWSGI stats server binding behavior

Goal: guarantee that the embedded stats server only listens on a trusted interface so internal metrics are not exposed to untrusted networks.

Constraint: the stats option accepts any address supplied by the user, including 0.0.0.0, and the documentation does not automatically restrict it to localhost. This leaves room for accidental public exposure if an operator mistakenly uses a wildcard address or relies on default behavior that changes when an address is given.

Uncertainty: whether uWSGI should provide a safety mechanism (e.g., a warning, a bind‑only‑localhost flag, or automatic fallback) to prevent unintended exposure without breaking existing configurations that intentionally expose stats.

Questions:

• Can a configuration option be added to enforce localhost binding for the stats server regardless of the supplied address?
• Should uWSGI emit a warning when the stats address is set to 0.0.0.0 or a non‑loopback interface?
• Is there a recommended way to enforce this restriction externally (e.g., via socket‑level firewall rules) while preserving the ability to override it deliberately?