security: bind Docker to localhost only (127.0.0.1)

README.md

@@ -98,7 +98,7 @@ Library/SDK usage, the full HTTP API, and MCP setup live in [docs/](docs/).
 
 ### Docker
 
-Run T3MP3ST API server in a container:
+Run T3MP3ST API server in a container (localhost only, not exposed externally):
 
 ```bash
 cp .env.example .env       # configure API keys
@@ -106,6 +106,8 @@ docker compose up -d       # API → http://localhost:3333
 docker compose logs -f     # view logs
 ```
 
+**Security Note:** Container binds to `127.0.0.1:3333` - accessible only from localhost, not exposed to network.
+
 Test the API:
 ```bash
 curl http://localhost:3333/api/health

docker-compose.yml

@@ -8,13 +8,13 @@ services:
     env_file:
       - .env
     environment:
-      - T3MP3ST_HOST=0.0.0.0
+      - T3MP3ST_HOST=127.0.0.1
       - T3MP3ST_PORT=3333
     volumes:
       - ./reports:/app/reports
       - ./evidence:/app/evidence
     ports:
-      - "3333:3333"
+      - "127.0.0.1:3333:3333"
     healthcheck:
       test: ["CMD", "node", "-e", "process.exit(0)"]
       interval: 30s