@@ -78,6 +78,7 @@
 - **CLI commands**: Most commands already accept `--config` for custom config paths. Upcoming work removes `--schema` / `--url` in favour of config-based resolution. When editing CLI help text, keep examples aligned with new config-first workflow.
   - For isolated Studio verification, you can run `packages/cli/src/Studio.ts` directly via `pnpm exec tsx` and pass a config object that preserves `loadedFromFile`; this keeps SQLite URLs resolving relative to the config file while avoiding unrelated `packages/cli/src/bin.ts` imports.
   - Studio is now pre-bundled into `packages/cli/build/studio.js` and `packages/cli/build/studio.css`, served only through explicit routes in `packages/cli/src/Studio.ts` via the runtime-specific `packages/cli/src/studio-server.ts` bindings, and should keep listener-level coverage in `packages/cli/src/__tests__/studio-server.vitest.ts` because a past Node regression dropped `GET` bodies by treating them like `HEAD`.
+  - Studio's local HTTP server must bind explicitly to `127.0.0.1`. Its request handler must reject browser requests whose `Origin` is not the active localhost or loopback URL before routing `/bff` or `/telemetry`; removing CORS response headers alone does not prevent cross-origin writes.
   - If Enter or click does not open a cell editor in Studio, verify that the current table and column are writable before assuming a keyboard regression; views/system tables and read-only columns legitimately stay non-editable.
 
 - **Driver adapters datasource**:
 
@@ -18,7 +18,7 @@ import { runtime } from 'std-env'
 
 import packageJson from '../package.json' assert { type: 'json' }
 import { STUDIO_CSS_FILE_NAME, STUDIO_JS_FILE_NAME, type StudioAdapterType } from './studio-frontend-shared'
-import { startStudioServer } from './studio-server'
+import { startStudioServer, STUDIO_SERVER_HOST } from './studio-server'
 import { UserFacingError } from './utils/errors'
 import { getPpgInfo } from './utils/ppgInfo'
 
@@ -278,6 +278,15 @@ ${bold('Examples')}
       return this.help()
     }
 
+    const requestedPort = args['--port']
+
+    if (
+      requestedPort !== undefined &&
+      (!Number.isInteger(requestedPort) || requestedPort < 1 || requestedPort > 65_535)
+    ) {
+      return new UserFacingError('The Studio port must be an integer between 1 and 65535.')
+    }
+
     const connectionString = args['--url'] || config.datasource?.url
 
     if (!connectionString) {
@@ -308,16 +317,16 @@ ${bold('Examples')}
     )
     const version = packageJson.dependencies['@prisma/studio-core']
     const ppgDbInfo = await getPpgInfo(connectionString)
+    const port = await resolveStudioPort(requestedPort)
     const handler = createStudioRequestHandler({
       adapter: studioStuff.adapter,
       executor,
       ppgDbInfo,
+      port,
       protocol,
       version,
     })
 
-    const port = args['--port'] || (await getPort({ port: DEFAULT_PORT, portRange: [MIN_PORT, DEFAULT_PORT - 1] }))
-
     const url = `http://localhost:${port}`
 
     const server = startStudioServer({
@@ -345,6 +354,18 @@ function getUrlBasePath(url: string | undefined, configPath: string | null): str
   return url ? process.cwd() : configPath ? dirname(configPath) : process.cwd()
 }
 
+async function resolveStudioPort(requestedPort: number | undefined): Promise<number> {
+  if (requestedPort !== undefined) {
+    return requestedPort
+  }
+
+  return getPort({
+    host: STUDIO_SERVER_HOST,
+    port: DEFAULT_PORT,
+    portRange: [MIN_PORT, DEFAULT_PORT - 1],
+  })
+}
+
 function serializeBffError(error: unknown): SerializedError {
   return getSerializedBffError(error) ?? serializeError(error)
 }
@@ -474,24 +495,26 @@ function createStudioRequestHandler({
   adapter,
   executor,
   ppgDbInfo,
+  port,
   protocol,
   version,
 }: {
   adapter: StudioAdapterType
   executor: Executor
   ppgDbInfo: Awaited<ReturnType<typeof getPpgInfo>>
+  port: number
   protocol: string
   version: string
 }): (request: Request) => Promise<Response> {
   let projectHash: string | null = null
 
   return async (request) => {
-    const { pathname } = new URL(request.url)
-
-    if (request.method === 'OPTIONS') {
-      return optionsResponse()
+    if (!isAllowedStudioOrigin(request, port)) {
+      return textResponse('Forbidden', 403)
     }
 
+    const { pathname } = new URL(request.url)
+
     if (isGetOrHeadRequest(request.method) && pathname === '/') {
       const contentType = FILE_EXTENSION_TO_CONTENT_TYPE[extname('index.html')]
 
@@ -630,12 +653,10 @@ async function serveStudioAsset(requestPath: string): Promise<Response> {
   const contentType = FILE_EXTENSION_TO_CONTENT_TYPE[extname(fileName)]
 
   try {
-    return withCors(
-      new Response(await readStudioAsset(fileName), {
-        headers: { 'Content-Type': contentType },
-        status: 200,
-      }),
-    )
+    return new Response(await readStudioAsset(fileName), {
+      headers: { 'Content-Type': contentType },
+      status: 200,
+    })
   } catch (error: unknown) {
     if (isNotFoundError(error)) {
       return textResponse('Not Found', 404)
@@ -676,36 +697,35 @@ function isNotFoundError(error: unknown): error is NodeJS.ErrnoException {
 }
 
 function jsonResponse(payload: unknown): Response {
-  return withCors(Response.json(payload))
+  return Response.json(payload)
 }
 
 function emptyResponse(status: number, headers?: Record<string, string>): Response {
-  return withCors(new Response(null, { headers, status }))
+  return new Response(null, { headers, status })
 }
 
-function optionsResponse(): Response {
-  return emptyResponse(204, {
-    'Access-Control-Allow-Headers': 'Content-Type',
-    'Access-Control-Allow-Methods': 'GET, HEAD, POST, OPTIONS',
+function textResponse(text: string, status: number, headers?: Record<string, string>): Response {
+  return new Response(text, {
+    headers,
+    status,
   })
 }
 
-function textResponse(text: string, status: number, headers?: Record<string, string>): Response {
-  return withCors(
-    new Response(text, {
-      headers,
-      status,
-    }),
-  )
-}
+function isAllowedStudioOrigin(request: Request, port: number): boolean {
+  const origin = request.headers.get('Origin')
 
-function withCors(response: Response): Response {
-  const headers = new Headers(response.headers)
-  headers.set('Access-Control-Allow-Origin', '*')
+  if (origin === null) {
+    return true
+  }
 
-  return new Response(response.body, {
-    headers,
-    status: response.status,
-    statusText: response.statusText,
-  })
+  try {
+    const normalizedOrigin = new URL(origin).origin
+
+    return (
+      normalizedOrigin === new URL(`http://localhost:${port}`).origin ||
+      normalizedOrigin === new URL(`http://127.0.0.1:${port}`).origin
+    )
+  } catch {
+    return false
+  }
 }