Addresses @sara blocker: documents that Spring Security's anyRequest().authenticated() guards these read endpoints and provides regression protection against accidental @PermitAll additions in future. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>