Dashboard publishes internal cluster addresses and unreachable Argo URLs

[castrojo]

Summary

The public factory dashboard and its published JSON expose internal cluster topology: node LAN addresses and ~97 http://192.168.x.x:PORT/... Argo workflow URLs.

These are RFC1918 addresses and are not reachable from the internet, so this is not a remotely exploitable issue. It is an information-disclosure and data-quality problem: it leaks internal topology and service ports, and the links are guaranteed broken for every public visitor.

Evidence

Rendered on https://factory.projectbluefin.io/ (Contributor Clusters cards):

• 192.168.1.102
• 192.168.1.170

In https://factory.projectbluefin.io/data/factory-stats.json:

• 97 distinct run_url values of the form
  http://192.168.1.102:32746/workflows/argo/dakota-commit-poller-1785599220
• Additional host addresses appear in the nodeSpecs map in the dashboard source.

Impact

• Publishes internal addressing and a NodePort for the Argo server.
• Every "Recent Runs" link is dead for the public, since it points into a private network.
• Plain-HTTP URLs on an HTTPS page.

Suggested fix

1. Drop the IP: line from the public machine cards. The cards are compelling because of the specs, OS image, and live CPU/memory — the address adds nothing for a visitor.
2. Either omit run_url when it is not publicly resolvable, or rewrite it to the corresponding GitHub Actions run URL. Rendering a link that cannot work is worse than rendering none.
3. Consider a collector-side guard that refuses to emit a private-range host in any public artifact, so this cannot regress silently.

Context

Found while auditing both dashboards ahead of consolidating project-level status onto https://docs.projectbluefin.io/factory. That page will not carry any host addressing; filing here so the source is fixed too.