diff --git a/app/README.md b/app/README.md
index 0744588c..6d3cf695 100644
--- a/app/README.md
+++ b/app/README.md
@@ -2,6 +2,8 @@
 
 A conversational RAG interface built with [CopilotKit](https://copilotkit.ai/) and [pydantic-ai](https://github.com/pydantic/pydantic-ai)'s AG-UI protocol.
 
+> **Note:** An illustrative example meant as a starting point, with no authentication. The compose files bind the backend to `127.0.0.1`; don't expose it to an untrusted network.
+
 ## Prerequisites
 
 - Docker and Docker Compose
diff --git a/app/docker-compose.dev.yml b/app/docker-compose.dev.yml
index 80aa36b3..5ecfa7f7 100644
--- a/app/docker-compose.dev.yml
+++ b/app/docker-compose.dev.yml
@@ -7,8 +7,9 @@ services:
       dockerfile: app/backend/Dockerfile
     command: ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]
     working_dir: /app/src
+    # No authentication; bound to loopback. The frontend reaches it over the compose network.
     ports:
-      - "8001:8000"
+      - "127.0.0.1:8001:8000"
     environment:
       - DB_PATH=/data
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
diff --git a/app/docker-compose.yml b/app/docker-compose.yml
index 72bdb3e0..305c0870 100644
--- a/app/docker-compose.yml
+++ b/app/docker-compose.yml
@@ -3,8 +3,9 @@ services:
     build:
       context: ..
       dockerfile: app/backend/Dockerfile
+    # No authentication; bound to loopback. The frontend reaches it over the compose network.
     ports:
-      - "8001:8000"
+      - "127.0.0.1:8001:8000"
     environment:
       - DB_PATH=/data
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
diff --git a/docs/apps.md b/docs/apps.md
index c77b95c6..f2633602 100644
--- a/docs/apps.md
+++ b/docs/apps.md
@@ -4,6 +4,9 @@ A browser-based reference implementation of conversational RAG, built on a Starl
 
 This is a starting point for your own deployments, not the canonical haiku.rag UX. For the day-to-day terminal experience see [Chat](chat.md).
 
+!!! warning "No authentication"
+    An illustrative example meant as a starting point, with no authentication. The compose files bind the backend to `127.0.0.1`; don't expose it to an untrusted network.
+
 ## Features
 
 - Streaming chat with real-time tool execution visibility.