Certain docker-compose files shipped by the project expose the Webadmin REST API publicly by default without proper authentication. Starting with version 3.9.1, the project mitigates this by setting a random credential on unprotected Webadmin endpoints to prevent unauthorized access while maintaining convenience.