diff --git a/cmd/artex/main.go b/cmd/artex/main.go
index 15d08e5..e794b9e 100644
--- a/cmd/artex/main.go
+++ b/cmd/artex/main.go
@@ -54,7 +54,7 @@ func run() int {
 	var (
 		addr    = flag.String("addr", ":8787", "HTTP listen address")
 		dataDir = flag.String("data", filepath.Join(config.BaseDir(), "data"), "data directory for SQLite stores (default: data/ next to the executable)")
-		proxy   = flag.String("proxy", ":8788", "traffic recording proxy address (empty to disable)")
+		proxy   = flag.String("proxy", "127.0.0.1:8788", "traffic recording proxy address (empty to disable)")
 	)
 	flag.Parse()
 
diff --git a/dev.sh b/dev.sh
index 39132dc..31e76cf 100755
--- a/dev.sh
+++ b/dev.sh
@@ -11,7 +11,7 @@ cleanup() { kill 0 2>/dev/null || true; }
 trap cleanup EXIT INT TERM
 
 # 后端（普通 go run，不内嵌前端）；并发 work agent 数在「系统设置」里配置。
-go run ./cmd/artex -addr :8787 -proxy :8788 &
+go run ./cmd/artex -addr :8787 -proxy 127.0.0.1:8788 &
 
 # 前端热更新（Vite/Next dev server，/api 反代到 :8787）。
 ( cd web && npm run dev ) &
diff --git a/docker-compose.yml b/docker-compose.yml
index a9c3371..ca788e4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,7 +29,7 @@ services:
       ARTEX_LLM_PROXY: ${ARTEX_LLM_PROXY:-}
     ports:
       - "8787:8787"
-      - "8788:8788"
+      - "127.0.0.1:8788:8788"
     volumes:
       # 把数据目录（含 jwt.key、SQLite 等）绑定到项目根目录的 data/，
       # 方便在宿主机直接查看/备份，容器重建也不丢。
diff --git a/traffic/proxy_test.go b/traffic/proxy_test.go
index fbf867b..8fefb61 100644
--- a/traffic/proxy_test.go
+++ b/traffic/proxy_test.go
@@ -57,3 +57,24 @@ func TestSetUpstreamProxyStoreClear(t *testing.T) {
 		t.Fatalf("invalid set mutated upstream to %v, want nil", got)
 	}
 }
+
+func TestProxyAddr(t *testing.T) {
+	cases := []struct {
+		addr string
+		want string
+	}{
+		// Bare :port means "bind all interfaces" — the legacy default. The URL
+		// agents consume must still point at loopback so they reach the local proxy.
+		{":8788", "http://127.0.0.1:8788"},
+		// Explicit loopback — the current default since #129 (open proxy exposure).
+		{"127.0.0.1:8788", "http://127.0.0.1:8788"},
+		// Explicit all-interface bind is still supported (remote capture via SSH).
+		{"0.0.0.0:8788", "http://0.0.0.0:8788"},
+	}
+	for _, c := range cases {
+		got := (&Traffic{addr: c.addr}).ProxyAddr()
+		if got != c.want {
+			t.Errorf("ProxyAddr(%q) = %q, want %q", c.addr, got, c.want)
+		}
+	}
+}
diff --git a/traffic/traffic.go b/traffic/traffic.go
index b9f4baf..e1d00f7 100644
--- a/traffic/traffic.go
+++ b/traffic/traffic.go
@@ -200,8 +200,14 @@ func hostOnly(hostport string) string {
 	return hostport
 }
 
-// ProxyAddr returns the address workers should set as HTTP(S)_PROXY.
-func (t *Traffic) ProxyAddr() string { return "http://127.0.0.1" + t.addr }
+// ProxyAddr returns the address workers should set as HTTP(S)_PROXY. A bare
+// ":port" means "bind all interfaces" (legacy default), so map it to loopback.
+func (t *Traffic) ProxyAddr() string {
+	if strings.HasPrefix(t.addr, ":") {
+		return "http://127.0.0.1" + t.addr
+	}
+	return "http://" + t.addr
+}
 
 // SetUpstreamProxy points every captured request at a global egress proxy
 // (http/https/socks5, optional user:pass in the URL). An empty raw string clears