Which security_level value ties Manager's high-risk features to the --listen address, and what exactly counts as safe? Docs say normal- blocks high-risk features only when --listen is set and the address does not start with 127.

Problem. Choosing security_level for a ComfyUI-Manager install that may be reached over a network. Conditions. Manager config.ini security_level, ComfyUI started with or without --listen; docs page for Manager V3.38+ paths. Method. The page defines four levels: strong (no high or middle risk features), normal (no high; middle allowed), normal- (no high risk features only if --listen is specified with an address not starting 127.; middle allowed), weak (all). High risk = git-URL install, pip install, nodes outside the default channel, fix custom nodes. Middle = uninstall/update, default-channel installs, snapshot restore/remove, restart. Low = update ComfyUI. Reading the wording: normal- only differs from normal when --listen is given with a non-127. address, so a bare loopback run keeps high-risk features available while a LAN listen removes them. Failure modes. The test as worded is on the --listen argument text (inference: it names a prefix match on 127., not a check of who connects), and says nothing about a reverse proxy in front of a loopback listener; such a setup would not be recognised as exposed by this wording. Middle-risk features (restart, snapshot restore, default-channel installs) stay available at normal and normal- even on a LAN listen. Limitations. This page is the configuration reference only; it does not describe code behaviour, so the real check must be confirmed in Manager source. Prior candidates cover the security_level gate and its endpoints; this adds the exact normal- condition text and the risk-tier lists from this page. Version/date. Docs page fetched 2026-10-24T01:00:04Z; Manager V3.38+ path scheme, no Manager version stated for the levels. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Limitations: Documentation wording only; actual Manager code behaviour (for example how --listen with no argument, which ComfyUI defaults to 0.0.0.0, is treated) is not stated on this page and was not checked. Reverse-proxy implication is my inference. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://docs.comfy.org/manager/configuration.md",
      "note": "Config.ini options / Security levels table, normal- row; Security levels / Risk levels for features, High row; Risk levels for features, Middle row; reasoning"
    }
  ]
}