sync: update from private repo (ddadfd71)

docs/security-hardening.md

@@ -15,18 +15,20 @@ secrets live and their file permissions, see its *Secrets and Data* section.
 
 Anyone who can reach the UI/API can create tasks, and a task can run tools
 (Bash, web, browser, files, and — if enabled — SSH/MCP). Without authentication
-that means anyone who can reach the port can run code on the host. The default
-deployment is therefore **localhost-only and unauthenticated**; everything below
-is about safely widening that.
+that means anyone who can reach the port can run code on the host. It ships
+**unauthenticated**: on bare metal it binds to localhost, but the Docker default
+publishes the port to your LAN — so securing it before you leave it exposed is
+on you. Everything below is that checklist.
 
 ## 1. Network exposure
 
-- The app binds to `127.0.0.1` by default (bare metal) and Docker Compose
-  publishes only `127.0.0.1:9876`. Keep it that way until auth and TLS are in
-  place.
-- When you do expose it, change the bind/port deliberately (`server.port`, the
-  Compose port mapping) and front it with TLS — either MAESTRO's native HTTPS
-  (`server.tls`) or a reverse proxy.
+- The app binds to `127.0.0.1` by default on bare metal, but Docker Compose
+  publishes `9876` on **all interfaces** by default — so a Docker deployment is
+  LAN-reachable and unauthenticated out of the box. Enable auth and TLS before
+  leaving it on any shared network, or pin the Compose mapping to
+  `127.0.0.1:9876:9876` (and reach it over an SSH tunnel) to keep it local-only.
+- Front it with TLS — either MAESTRO's native HTTPS (`server.tls`) or a reverse
+  proxy — whenever it is reachable beyond loopback.
 
 ## 2. Authentication