captain serve documents that off-box requests require a token, but token authentication applies only to /api/v1 and /git. Other API routes remain reachable without a token when the server listens beyond loopback, including chat, attachments, session and prompt controls, tasks, and Kubernetes Secret and ConfigMap metadata.
Remote callers can therefore access host-backed Captain capabilities despite the server being configured for token-authenticated remote use.
captain servedocuments that off-box requests require a token, but token authentication applies only to/api/v1and/git. Other API routes remain reachable without a token when the server listens beyond loopback, including chat, attachments, session and prompt controls, tasks, and Kubernetes Secret and ConfigMap metadata.Remote callers can therefore access host-backed Captain capabilities despite the server being configured for token-authenticated remote use.