Given this is largely talking about sniffing development platforms, it could also require a nonce registered in the app and the frontend and only respond if tha

Given this is largely talking about sniffing development platforms, it could also require a nonce registered in the app and the frontend and only respond if that's sent via a header. This would prevent having to worry about people who use other hostnames for host even in localdev.