What are the security risks of publicly exposing the Node.js debugger port, and what are the recommended safe practices for enabling remote debugging according to the official documentation? Specifically, how does `--inspect` behave by default, and what is the primary recommended method for remote connections?
Navigate to 'nodejs.org'. Go to the 'Learn' section. Locate and navigate to the 'Debugging Node.js' page. Identify the 'Security Implications' section and the 'Enabling remote debugging scenarios' subsection. Extract information regarding debugger access, risks of public exposure, default binding of `--inspect`, and recommended remote debugging methods. Summarize the key security implications and the recommended approach for safe remote debugging.
State that the debugger has full access to the Node.js execution environment, allowing a malicious actor to execute arbitrary code if connected. Mention that exposing the debug port publicly (binding to a public IP or 0.0.0.0) is unsafe and allows unrestricted connection. Confirm that by default, `--inspect` binds to `127.0.0.1` for security reasons. Refer to the advice about ensuring appropriate firewalls and access controls are in place to prevent security exposure for remote debugging scenarios, and specifically mention the recommendation to use SSH tunnels instead of public IP binding.