Canvas security boundary: require token on public IP, allow IP fallback only on private/loopback

• Canvas endpoint is enabled and reachable from at least one trusted client.
• You can test from both local/private network and public ingress paths.

1. From loopback/LAN, test canvas flow without bearer token to confirm expected local fallback behavior.
2. From a public ingress path, repeat same request and verify it is denied without bearer token.
3. Update client integrations to always attach bearer token for public or uncertain network paths.
4. Record this boundary in ops runbook to avoid future accidental exposure.

• Corporate VPN/proxy topologies can blur IP classification; validate with real traffic path（需验证）.
• Do not treat IP-based fallback as primary auth model; bearer token remains the robust control.

This tip is aggregated from community/public sources and preserved with attribution.