Exposing a local port through a public tunnel

Holds a command that puts a local service on a public URL through a tunnel: ngrok http|tcp|start, cloudflared tunnel, localtunnel / lt --port, tailscale funnel, an ssh -R remote forward (including -NR, matched only when ssh is the command being run), the serveo.net and localhost.run SSH relays, bore local, frpc invoked with a flag (frpc -c …), and pinggy.io. Each reaches past the firewall and gives the outside world a route in, which is a demo convenience and an exfiltration channel both. Deliberately NOT matched: ssh -L (a local forward, inbound to you) and ssh -D (a SOCKS proxy), ngrok config check / --version, cloudflared --version, tailscale status / serve (which stays inside the tailnet), ssh-keygen -R host (host-key removal, not a tunnel), a -R that appears only inside a quoted remote command (ssh host "grep -R …"), and a path or filename that merely contains frpc (scripts/frpc-parser.js). MISSES a tunnel binary run under another name, a raw ssh -R to a private relay this list does not name, frp driven from its config file rather than the frpc command, sudo frpc, and an frpc subcommand invoked without a leading flag. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.