Sextile runs locally and reads the charts you give it. The http preview answers only requests whose Host is localhost, and the Docker image publishes the preview port to 127.0.0.1 only; the README's install does the rest.

To report a vulnerability, open a GitHub security advisory on this repository (Security → Report a vulnerability) rather than a public issue. You will get an answer within a week.