Vagrant insecure by default?

Question

EDIT 2: TL;DR: the answer was yes in 2013, but this flaw has been fixed

By following the Getting Started instructions on vagrantup.

Answer 1

As of Vagrant 1.2.3 the default is to bind to localhost instead of the public interface, avoiding the external connection issue.