From a6547eda2f6583336411078e7434617fa2b16226 Mon Sep 17 00:00:00 2001
From: Rene Fichtmueller <rf@flexoptix.net>
Date: Fri, 17 Jul 2026 19:06:22 +0200
Subject: [PATCH] chore(security): scrub subscription bridge placeholders

---
 packages/gateway/src/modules/bridge-spawner.ts         | 6 +++---
 packages/gateway/src/modules/subscription-discovery.ts | 4 ++--
 packages/gateway/src/routes/subscriptions.ts           | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/packages/gateway/src/modules/bridge-spawner.ts b/packages/gateway/src/modules/bridge-spawner.ts
index 6344eff..d4e3639 100644
--- a/packages/gateway/src/modules/bridge-spawner.ts
+++ b/packages/gateway/src/modules/bridge-spawner.ts
@@ -324,7 +324,7 @@ export function spawnBridge(desc: SubscriptionDescriptor): Promise<RunningBridge
           { subscription: desc.id, port: desc.bridgePort },
           'Port already in use — assuming external bridge is healthy'
         );
-        const url = `http://127.0.0.1:${desc.bridgePort}`;
+        const url = `http://localhost:${desc.bridgePort}`;
         const fakeBridge: RunningBridge = {
           descriptor: desc,
           server, // server failed to bind; OK to keep handle
@@ -339,8 +339,8 @@ export function spawnBridge(desc: SubscriptionDescriptor): Promise<RunningBridge
       }
     });
 
-    server.listen(desc.bridgePort, '127.0.0.1', () => {
-      const url = `http://127.0.0.1:${desc.bridgePort}`;
+    server.listen(desc.bridgePort, 'localhost', () => {
+      const url = `http://localhost:${desc.bridgePort}`;
       const bridge: RunningBridge = {
         descriptor: desc,
         server,
diff --git a/packages/gateway/src/modules/subscription-discovery.ts b/packages/gateway/src/modules/subscription-discovery.ts
index 97146f0..c21ab9d 100644
--- a/packages/gateway/src/modules/subscription-discovery.ts
+++ b/packages/gateway/src/modules/subscription-discovery.ts
@@ -238,7 +238,7 @@ async function probeBridge(url: string | undefined): Promise<boolean> {
 /**
  * Resolve the bridge URL for a subscription:
  *   1. Explicit env var (CLAUDE_BRIDGE_URL etc.) — set by Settings or PM2 ecosystem
- *   2. Auto-detect: probe http://127.0.0.1:{bridgePort} for a /health endpoint
+ *   2. Auto-detect: probe http://localhost:{bridgePort} for a /health endpoint
  *
  * This means a bridge running locally on its default port is picked up
  * automatically without any configuration.
@@ -250,7 +250,7 @@ async function resolveBridgeUrl(desc: SubscriptionDescriptor): Promise<{ url?: s
     return { url: explicit, running };
   }
   // Auto-detect on the default port
-  const localUrl = `http://127.0.0.1:${desc.bridgePort}`;
+  const localUrl = `http://localhost:${desc.bridgePort}`;
   const running = await probeBridge(localUrl);
   return running ? { url: localUrl, running: true } : { running: false };
 }
diff --git a/packages/gateway/src/routes/subscriptions.ts b/packages/gateway/src/routes/subscriptions.ts
index 76c7fe3..22ae35f 100644
--- a/packages/gateway/src/routes/subscriptions.ts
+++ b/packages/gateway/src/routes/subscriptions.ts
@@ -40,7 +40,7 @@ function configuredBridgeUrl(status: SubscriptionStatus, runningById: Map<string
 }
 
 function defaultBridgeUrl(status: SubscriptionStatus): string {
-  return `http://127.0.0.1:${status.descriptor.bridgePort}`;
+  return `http://localhost:${status.descriptor.bridgePort}`;
 }
 
 function bridgeBaseUrl(url: string): string {
@@ -78,12 +78,12 @@ function buildAccessCard(
     subscriptionStatusUrl: `${baseUrl}/api/subscriptions?search=${encodeURIComponent(status.descriptor.id)}`,
     headers: {
       'Content-Type': 'application/json',
-      Authorization: 'Bearer ${LLM_GATEWAY_API_KEY}',
+      Authorization: 'Bearer <key>',
       'X-Caller-ID': 'your-service-name',
     },
     env: {
       LLM_GATEWAY_URL: baseUrl,
-      LLM_GATEWAY_API_KEY: '${LLM_GATEWAY_API_KEY}',
+      LLM_GATEWAY_API_KEY: '<key>',
       LLM_GATEWAY_MODEL: defaultModel,
       LLM_GATEWAY_SUBSCRIPTION: status.descriptor.id,
     },