diff --git a/docs/explorer-setup.md b/docs/explorer-setup.md index f023730e..4d8caa1f 100644 --- a/docs/explorer-setup.md +++ b/docs/explorer-setup.md @@ -162,7 +162,7 @@ semantica-explorer --graph my_graph.json --no-browser ``` - `--host 0.0.0.0` makes Explorer reachable on every network interface. The server has no built-in authentication. Only use this on a trusted private network. + `--host 0.0.0.0` makes Explorer reachable on every network interface. Since v0.6.5 the Explorer API requires `SEMANTICA_API_KEY` (sent as the `X-API-Key` header) and fails closed with `503` when unconfigured; unauthenticated access is only possible when `SEMANTICA_ALLOW_ANONYMOUS=true` is set explicitly. Only use this on a trusted private network. diff --git a/explorer/README.md b/explorer/README.md index 3884aaee..3f5c313e 100644 --- a/explorer/README.md +++ b/explorer/README.md @@ -63,7 +63,9 @@ semantica-explorer --graph my_graph.json --no-browser python -m semantica.explorer --graph my_graph.json ``` -> **Security note:** The Explorer API has no built-in authentication. The default `--host 127.0.0.1` binds to localhost only, so it is not reachable from other machines on your network. If you bind to `0.0.0.0`, all graph data is readable and writable by any host that can reach the port. The CLI will print a warning in that case. +> **Security note:** Since v0.6.5 the Explorer API requires an API key. Set the `SEMANTICA_API_KEY` environment variable and send it as the `X-API-Key` header on every request; without a configured key, protected routes fail closed with `503` rather than serving anonymously. To opt into unauthenticated access for local development only, set `SEMANTICA_ALLOW_ANONYMOUS=true` explicitly. +> +> The default `--host 127.0.0.1` binds to localhost only, so it is not reachable from other machines on your network. If you bind to `0.0.0.0`, all graph data is readable and writable by any host that can reach the port (subject to API-key auth); the CLI will print a warning in that case. ---