The current security guidance consists of a brief warning under "Option 6: Running as an HTTP Server" with a few bullet points of high-level advice like "implement authentication (e.g., API gateway, ...