diff --git a/scripts/byok_guard.py b/scripts/byok_guard.py
index 0026ad7..a3bb536 100644
--- a/scripts/byok_guard.py
+++ b/scripts/byok_guard.py
@@ -7,6 +7,8 @@ providers. Used by Settings (activation warning) and app.py (sidebar indicator).
 No Streamlit dependency — pure Python so it's unit-testable and reusable.
 """
 
+# 0.0.0.0 is a bind address (all interfaces), not a true loopback, but a backend
+# configured to call it is talking to the local machine — treat as local.
 LOCAL_URL_MARKERS = ("localhost", "127.0.0.1", "0.0.0.0")
 
 
diff --git a/tests/test_byok_guard.py b/tests/test_byok_guard.py
index 718c190..a662dd6 100644
--- a/tests/test_byok_guard.py
+++ b/tests/test_byok_guard.py
@@ -41,6 +41,11 @@ class TestIsCloudBackend:
         cfg = {"type": "anthropic", "local": True}
         assert is_cloud_backend("anthropic", cfg) is False
 
+    def test_openai_compat_missing_base_url_treated_as_cloud(self):
+        # No base_url → unknown destination → defensively treated as cloud
+        cfg = {"type": "openai_compat"}
+        assert is_cloud_backend("unknown", cfg) is True
+
     def test_unknown_type_without_url_is_local(self):
         assert is_cloud_backend("mystery", {"type": "unknown_type"}) is False