The app.py file has the share=True option enabled by default, which may expose internal network services without the user's knowledge

[LJFYYJ]

Risk: The command app.py's block.launch(share=True) defaults to enabling Gradio's share=True. This can potentially create a direct FRP tunnel, exposing internal network services to the public without the user's awareness, increasing the risk of the user's machine being compromised.

Reference: In the stable-diffusion-webui project, the default setting when running ./webui.sh is share=False. The FRP tunnel is only established if the user adds the parameter ./webui.sh --share, making services accessible from the public.

Recommendation: Remove the share=True parameter from app.py to ensure that the default configuration is secure, meaning that the service is only available on 127.0.0.1:7860. If users need to expose the service to the public, they can add the corresponding parameter themselves.