Update docs around security implication for exposing set middleware API

Author: tommysitu

docs/pages/keyconcepts/middleware.rst

@@ -25,13 +25,13 @@ You can write middleware in any language. There are two different types of middl
 
 Local Middleware
 ----------------
-Hoverfly has the ability to invoke middleware by executing a script or binary file on a host operating system. 
+Hoverfly has the ability to invoke middleware by executing a script or binary file on a host operating system.
 The only requires are that the provided middleware can be executed and sends the Middleware JSON schema to stdout
 when the Middleware JSON schema is received on stdin.
 
 HTTP Middleware
 ---------------
-Hoverfly can also send middleware requests to a HTTP server instead of running a process locally. The benefits of this 
+Hoverfly can also send middleware requests to a HTTP server instead of running a process locally. The benefits of this
 are that Hoverfly does not initiate the process, giving more control to the user. The only requirements are that Hoverfly can
 POST the Middleware JSON schema to middleware URL provided and the middleware HTTP server responses with a 200 and the
 Middleware JSON schema is in the response.
@@ -50,3 +50,30 @@ Hoverfly will send the JSON object to middleware via the standard input stream.
 .. seealso::
 
     Middleware examples are covered in the tutorials section. See :ref:`randomlatency` and :ref:`modifyingresponses`.
+
+
+Security and availability of the Set Middleware API
+---------------------------------------------------
+
+By default, the admin endpoint to set middleware (PUT /api/v2/hoverfly/middleware) is disabled. To enable it:
+
+- When starting Hoverfly directly: run with the flag: -enable-middleware-api
+- When starting via hoverctl: use the same flag on start: hoverctl start --enable-middleware-api
+
+Network binding and remote access
+---------------------------------
+
+By default, Hoverfly binds its Admin and Proxy ports to the loopback interface only (127.0.0.1). This means the Admin API is not reachable from remote hosts out of the box.
+
+.. warning::
+
+   Exposing the Admin API outside localhost increases risk, especially if the Set Middleware API is enabled, because it allows executing arbitrary scripts/binaries on the host (for local middleware) or invoking remote middleware services.
+
+   If you expose the Admin API and enable the Set Middleware API, you should:
+
+   - Run Hoverfly only on trusted/private networks.
+   - Restrict access to the Admin API to trusted callers and networks (e.g., via firewalls, security groups, VPNs, reverse proxy ACLs).
+   - Prefer binding to localhost unless there is a strong need to expose it, and scope exposure to the minimum required interfaces.
+   - Enable authentication if appropriate and avoid exposing the Admin port publicly.
+
+The guidance above applies whether you configure middleware as a local executable/script or as HTTP middleware.