Redis had no auth, defended only by not being port-mapped to the host. Defense-in-depth per the audit — REDIS_PASSWORD is generated server-side in docker/.env (not committed) and threaded through to both the redis service's --requirepass and the app's REDIS_URL.