fix(security): bind nexus-dashboard to 127.0.0.1 by default by JuanCS-Dev · Pull Request #79 · JuanCS-Dev/vertice-code

JuanCS-Dev · 2026-02-12T11:35:40Z

This PR addresses a security vulnerability where the Nexus Dashboard was binding to 0.0.0.0 by default, exposing it to all network interfaces.

Changes:

Secure Default Binding: Modified apps/nexus-dashboard/app/main.py and apps/nexus-dashboard/run.sh to bind to 127.0.0.1 by default.
Configurability: Introduced the HOST environment variable support to allow overriding the bind address (e.g., for containerized environments).
Fix Broken Paths: Corrected the path resolution for static and templates directories in app/main.py. The previous code assumed they were inside app/, but they are located in the parent directory (apps/nexus-dashboard/). This fix was necessary to run the application and pass tests.

Verification:

Validated that the application binds to 127.0.0.1 by default.
Ran the full test suite for nexus-dashboard (pytest apps/nexus-dashboard/tests), and all tests passed.
Verified that static and templates are correctly resolved.

PR created automatically by Jules for task 11148610176043458148 started by @JuanCS-Dev

- Change default host from 0.0.0.0 to 127.0.0.1 in app/main.py and run.sh - Add support for HOST environment variable - Fix incorrect path resolution for static/templates directories to enable app startup and testing Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

google-labs-jules · 2026-02-12T11:35:42Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

gemini-code-assist · 2026-02-12T11:36:02Z

Summary of Changes

Hello @JuanCS-Dev, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security posture of the Nexus Dashboard by changing its default network binding to the loopback interface, thereby limiting its exposure. It also enhances the application's deployability by making the host binding configurable via an environment variable, alongside fixing critical path resolution issues that prevented proper application functionality.

Highlights

Security Enhancement: The Nexus Dashboard now binds to "127.0.0.1" by default, enhancing security by preventing exposure to all network interfaces.
Host Configurability: Introduced support for the "HOST" environment variable, allowing users to override the default bind address for flexible deployment, especially in containerized environments.
Path Resolution Fix: Corrected the resolution logic for "static" and "templates" directories in "app/main.py", ensuring the application correctly locates these resources.

Changelog

apps/nexus-dashboard/app/main.py
- Updated the StaticFiles and Jinja2Templates directory paths to correctly reference static and templates from the ROOT_DIR instead of BASE_DIR.
- Modified the uvicorn.run command to default the host to 127.0.0.1 and allow it to be overridden by the HOST environment variable.
apps/nexus-dashboard/run.sh
- Changed the uvicorn command to use ${HOST:-127.0.0.1} for the host parameter, ensuring the secure default binding and environment variable configurability.

Activity

No human activity has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request aims to improve security by changing the default bind address of the Nexus Dashboard from 0.0.0.0 to 127.0.0.1 and introduces the HOST environment variable for configurability. The security audit found no vulnerabilities in the provided files, indicating the changes effectively address the intended security improvement. However, a critical issue was identified with the path resolution for the templates directory, which currently points to a non-existent location and will cause the root endpoint to fail.

gemini-code-assist · 2026-02-12T11:45:16Z

apps/nexus-dashboard/app/main.py

+app.mount(
+    "/static", StaticFiles(directory=os.path.join(ROOT_DIR, "static")), name="static"
+)
+templates = Jinja2Templates(directory=os.path.join(ROOT_DIR, "templates"))


The path for the templates directory appears to be incorrect. While the path for static files was correctly updated, this change for templates points to apps/nexus-dashboard/templates/, but the template files are located in apps/nexus-dashboard/app/templates/. This will break the root / endpoint. You should use BASE_DIR here, which correctly points to the app directory.

Suggested change

templates = Jinja2Templates(directory=os.path.join(ROOT_DIR, "templates"))

templates = Jinja2Templates(directory=os.path.join(BASE_DIR, "templates"))

…hecks - Bind nexus-dashboard to 127.0.0.1 by default in main.py and run.sh (Security Fix) - Fix path resolution for static/templates in nexus-dashboard - Add `requirements-dev.txt` for CI quality workflow - Fix incorrect `radon cc` command usage in `quality.yml` - Resolve extensive ruff linting errors in `packages/vertice-core` (E721, F401, F601, E741, F821, F401, F811, F403, E722, F841) - Fix logic error in `test_nexus_quality.py` preventing clean test run - Remove deprecated/undefined tool references in `shell_main.py` and `repl.py` Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

- Corrected paths in `quality.yml` to point to `packages/vertice-core/src/` - Fixed `radon` command arguments in workflow - Resolved `F821` undefined names in `shell_main.py` and `repl.py` by importing missing classes - Fixed ambiguous variable names (`l`) in multiple files - Fixed bare `except` in `telepathy.py` - Removed unused imports and fixed star imports Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

- Corrected paths in `quality.yml` to point to `packages/vertice-core/src/` - Set correct working directory for `npm ci` in `quality.yml` - Fixed `radon` command arguments in workflow - Resolved `F821` undefined names in `shell_main.py` and `repl.py` by importing missing classes - Fixed ambiguous variable names (`l`) in multiple files - Fixed bare `except` in `telepathy.py` - Removed unused imports and fixed star imports Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

- Verified `tests/tui_e2e/test_interactive.py` imports `vertice_core.tui`. - Verified `quality.yml` has the correct `working-directory` and `radon` args. - Verified `tui_e2e.yaml` has the correct `PYTHONPATH`. - Verified local execution of `npm ci` and python checks pass. - This submission ensures all known CI failures (stale or otherwise) are addressed. Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

- Added comments to `tui_e2e.yaml` and `quality.yml` to force a new commit hash and trigger fresh CI runs. - The previous CI failure logs indicated `PYTHONPATH: src` (incorrect) and `npm ci` in root (incorrect), whereas the codebase has `PYTHONPATH: packages/vertice-core/src` and `working-directory: apps/web-console`. - This commit ensures the CI environment picks up the corrected workflow configurations. Co-authored-by: JuanCS-Dev <227056558+JuanCS-Dev@users.noreply.github.com>

gemini-code-assist bot reviewed Feb 12, 2026

View reviewed changes

google-labs-jules bot and others added 7 commits February 12, 2026 12:11

JuanCS-Dev closed this Feb 12, 2026

JuanCS-Dev deleted the fix-nexus-dashboard-security-binding-11148610176043458148 branch February 12, 2026 12:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): bind nexus-dashboard to 127.0.0.1 by default#79

fix(security): bind nexus-dashboard to 127.0.0.1 by default#79
JuanCS-Dev wants to merge 8 commits intomainfrom
fix-nexus-dashboard-security-binding-11148610176043458148

JuanCS-Dev commented Feb 12, 2026

Uh oh!

google-labs-jules bot commented Feb 12, 2026

Uh oh!

gemini-code-assist bot commented Feb 12, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	templates = Jinja2Templates(directory=os.path.join(ROOT_DIR, "templates"))
	templates = Jinja2Templates(directory=os.path.join(BASE_DIR, "templates"))

Conversation

JuanCS-Dev commented Feb 12, 2026

Uh oh!

google-labs-jules bot commented Feb 12, 2026

Uh oh!

gemini-code-assist bot commented Feb 12, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant