These local runtime tools come without passwords by default, so port bindings should be checked to avoid exposing services to the public internet.