By default, it starts up exposing the file server on all interfaces, not just localhost, AKA insecure by default.

Such a poor security choice, makes me question the entire project.