KB / Memory / tech-hermes-dashboard-auth-gate
Dashboard auth gate precedence
Insecure/loopback allowlists can bypass OAuth if ordered wrong
Generic lesson: localhost/insecure allowlists must not outrank real auth on exposed binds.
Prefer explicit bind address + auth plugin order tests. Related: feedback-public-kb-only, tech-forwardauth-preserve-status.