I can see your local web servers

Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost.

Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)

But frontend applications expose mangled javascript which can be reverse engineered anyway

It can be done, but it is usually uglified. No need to give the plain source to outsiders.