diff --git a/.env.example b/.env.example
index a736ce7..478fd16 100644
--- a/.env.example
+++ b/.env.example
@@ -13,6 +13,15 @@ SERVER_SECRET_KEY=your_server_private_key_here
 # OPTIONAL CONFIGURATION
 # =============================================================================
 
+# =============================================================================
+# CONFIG MANAGER AUTHENTICATION
+# =============================================================================
+
+# Credentials for the web-based config manager (port 3000)
+# If not set, a random password will be generated on startup and printed to the console
+# MANAGER_USER=admin
+# MANAGER_PASSWORD=your_secure_password_here
+
 # Default perspective pubkey for trust calculations (hex format)
 # Default: Gigi's pubkey (6e468422dfb74a5738702a8823b9b28168abab8655faacb6853cd0ee15deee93)
 DEFAULT_SOURCE_PUBKEY=6e468422dfb74a5738702a8823b9b28168abab8655faacb6853cd0ee15deee93
diff --git a/docker-compose.yml b/docker-compose.yml
index a4fea96..80b6408 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,7 +32,8 @@ services:
       - ./plugins:/usr/src/app/plugins
 
     ports:
-      - 3000:3000
+      # Bind to localhost by default to prevent accidental public exposure
+      - 127.0.0.1:3000:3000
 
     # Restart policy for production reliability
     restart: unless-stopped
diff --git a/manager.ts b/manager.ts
index 7bb8542..b4ee485 100755
--- a/manager.ts
+++ b/manager.ts
@@ -3,6 +3,7 @@
 /** Entry point for the config and process manager */
 import { startServer } from "process-pastry";
 import { parseArgs } from "util";
+import { randomBytes } from "crypto";
 
 import configApp from "./config-ui/index.html";
 
@@ -22,6 +23,17 @@ const { values } = parseArgs({
   allowPositionals: true,
 });
 
+const managerUser = process.env.MANAGER_USER || "admin";
+let managerPassword = process.env.MANAGER_PASSWORD;
+
+if (!managerPassword) {
+  managerPassword = randomBytes(16).toString("hex");
+  console.log(`\n⚠️  WARNING: No MANAGER_PASSWORD set in environment.`);
+  console.log(`🔒 Generated temporary password for config manager:`);
+  console.log(`   User: ${managerUser}`);
+  console.log(`   Password: ${managerPassword}\n`);
+}
+
 // Start process-pastry server with the bundled HTML
 startServer({
   port: 3000,
@@ -29,6 +41,8 @@ startServer({
   command: values.command
     ? values.command.split(" ")
     : ["bun", "run", "src/mcp/server.ts"],
+  authUser: managerUser,
+  authPassword: managerPassword,
   // Expose existing environment variables to the config UI
   expose: [
     "SERVER_SECRET_KEY",