security: bind Docker to localhost only (127.0.0.1)

README.md

@@ -98,7 +98,7 @@ Library/SDK usage, the full HTTP API, and MCP setup live in [docs/](docs/).
 
 ### Docker
 
-Run T3MP3ST API server in a container:
+Run T3MP3ST API server in a container (localhost only, not exposed externally):
 
 ```bash
 cp .env.example .env       # configure API keys
@@ -106,6 +106,8 @@ docker compose up -d       # API → http://localhost:3333
 docker compose logs -f     # view logs
 ```
 
+**Security Note:** Container binds to `127.0.0.1:3333` - accessible only from localhost, not exposed to network.
+
 Test the API:
 ```bash
 curl http://localhost:3333/api/health