3/ Safe by default: loopback-only, Host/Origin checks, optional token, DATABASE_URL / JWT_SECRET / "token=…" in logs get redacted, and it's off when NODE_ENV=production.

Just shipped NodeUI v0.3.1 🚀 An embedded dev console for Express, Fastify & NestJS: 📊 live health, req/s, p95, errors 🌐 requests + copy as curl 🩺 DB/Redis checks 🔒 local-only, secrets redacted