Expo dev server tunnel missing authentication boundary for local development URLs
Context Expo's expo start --tunnel command exposes a local Metro bundler instance through a publicly reachable ngrok URL. The generated link allows any holder to load the running application without authentication, IP allowlisting, or token verification by default. Constraint gap No built-in mechanism requires an explicit opt-in for access control when the t
expo