IMO, the default configuration should be the most secure one, to be safe: production settings and not open to the world (especially since Starman is most often used behind a proxy anyway).