In the standard configs the jmx and osgi-http interfaces shouldn't be bound by default to the "public" interface, as users are likely to configure that interface to be open for insecure use.