diff --git a/README.md b/README.md
index e4c0aca..16a2f5e 100755
--- a/README.md
+++ b/README.md
@@ -98,7 +98,7 @@ Library/SDK usage, the full HTTP API, and MCP setup live in [docs/](docs/).
 
 ### Docker
 
-Run T3MP3ST API server in a container:
+Run T3MP3ST API server in a container (localhost only, not exposed externally):
 
 ```bash
 cp .env.example .env       # configure API keys
@@ -106,6 +106,8 @@ docker compose up -d       # API → http://localhost:3333
 docker compose logs -f     # view logs
 ```
 
+**Security Note:** Container binds to `127.0.0.1:3333` - accessible only from localhost, not exposed to network.
+
 Test the API:
 ```bash
 curl http://localhost:3333/api/health
diff --git a/docker-compose.yml b/docker-compose.yml
index 381fae1..48ff696 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,13 +8,13 @@ services:
     env_file:
       - .env
     environment:
-      - T3MP3ST_HOST=0.0.0.0
+      - T3MP3ST_HOST=127.0.0.1
       - T3MP3ST_PORT=3333
     volumes:
       - ./reports:/app/reports
       - ./evidence:/app/evidence
     ports:
-      - "3333:3333"
+      - "127.0.0.1:3333:3333"
     healthcheck:
       test: ["CMD", "node", "-e", "process.exit(0)"]
       interval: 30s