Secure by default uplift (#511)

Co-authored-by: Alex Kenley <Alex.Kenley@threatvectorsecurity.com>

.env.example

@@ -49,7 +49,9 @@ SEARXNG_INSTANCE=http://localhost:8080
 # Enable authentication (default: true)
 # AUTH_ENABLED=true
 
-# Host port for the Odysseus web UI in Docker Compose.
+# Host bind address and port for the Odysseus web UI in Docker Compose.
+# Keep APP_BIND on loopback unless you intentionally want LAN/reverse-proxy access.
+# APP_BIND=127.0.0.1
 # Change this if another local service already uses 7000 (macOS AirPlay often does).
 # APP_PORT=7000