From fad89aecf93a30069e615f5fc1646d6ac5759e31 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 24 Jun 2026 03:48:32 -0700
Subject: [PATCH] Clarify Studio --secure hint exposes a public Cloudflare
 tunnel (#6615)

The installer/setup launch hints described --secure as merely allowing
HTTPS. In practice --secure forces a loopback bind and opens a public
Cloudflare quick tunnel (https://*.trycloudflare.com) to Studio, which
serves Python/terminal tools by default, so the old wording understated
the exposure. Update the hint to say it is a public Cloudflare HTTPS link
and that anyone with the API key can run code, matching the runtime
secure-mode banner.
---
 install.ps1     | 4 ++--
 install.sh      | 4 ++--
 studio/setup.sh | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/install.ps1 b/install.ps1
index 745c7369ea..f7f9540970 100644
--- a/install.ps1
+++ b/install.ps1
@@ -2595,7 +2595,7 @@ exit 0
             step "launch" "to start later, run:"
             substep "unsloth studio -p 8888"
             substep "(add -H 0.0.0.0 to allow network / cloud access)"
-            substep "(add --secure to allow HTTPS)"
+            substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
             Write-Host ""
         }
     } else {
@@ -2616,7 +2616,7 @@ exit 0
             substep "unsloth studio -p 8888"
         }
         substep "(add -H 0.0.0.0 to allow network / cloud access)"
-        substep "(add --secure to allow HTTPS)"
+        substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
         Write-Host ""
     }
 }
diff --git a/install.sh b/install.sh
index 5038de6264..b3eaa61003 100755
--- a/install.sh
+++ b/install.sh
@@ -3154,7 +3154,7 @@ if [ -t 1 ]; then
             step "launch" "to start later, run:"
             substep "unsloth studio -p 8888"
             substep "(add -H 0.0.0.0 to allow network / cloud access)"
-            substep "(add --secure to allow HTTPS)"
+            substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
             echo ""
             ;;
     esac
@@ -3176,6 +3176,6 @@ else
         substep "unsloth studio -p 8888"
     fi
     substep "(add -H 0.0.0.0 to allow network / cloud access)"
-    substep "(add --secure to allow HTTPS)"
+    substep "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
     echo ""
 fi
diff --git a/studio/setup.sh b/studio/setup.sh
index e22186319f..2e1be1c9c2 100755
--- a/studio/setup.sh
+++ b/studio/setup.sh
@@ -1822,7 +1822,7 @@ else
         printf "  ${C_DIM}%-15s${C_OK}%s${C_RST}\n" "launch" "unsloth studio -p 8888"
     fi
     printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add -H 0.0.0.0 to allow network / cloud access)"
-    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add --secure to allow HTTPS)"
+    printf "  ${C_DIM}%-15s%s${C_RST}\n" "" "(add --secure for a public Cloudflare HTTPS link; anyone with the API key can run code)"
 fi
 echo ""