diff --git a/basics/pda-rent-payer/anchor/programs/anchor-program-example/src/instructions/create_new_account.rs b/basics/pda-rent-payer/anchor/programs/anchor-program-example/src/instructions/create_new_account.rs
index 706746382..30803262b 100644
--- a/basics/pda-rent-payer/anchor/programs/anchor-program-example/src/instructions/create_new_account.rs
+++ b/basics/pda-rent-payer/anchor/programs/anchor-program-example/src/instructions/create_new_account.rs
@@ -1,6 +1,11 @@
 use anchor_lang::prelude::*;
 use anchor_lang::system_program::{create_account, CreateAccount};
 
+// NOTE: this example does not restrict who may call it. A real rent vault
+// needs an authority check: a `has_one` against an admin recorded at
+// initialization, seeds that bind the vault to one funder, or a per-caller
+// limit. A bare `authority: Signer` alone is not enough, since any keypair
+// can sign for itself.
 #[derive(Accounts)]
 pub struct CreateNewAccount<'info> {
     #[account(mut)]
diff --git a/basics/pda-rent-payer/native/program/src/instructions/create_new_account.rs b/basics/pda-rent-payer/native/program/src/instructions/create_new_account.rs
index 071b8127e..23fec2e9d 100644
--- a/basics/pda-rent-payer/native/program/src/instructions/create_new_account.rs
+++ b/basics/pda-rent-payer/native/program/src/instructions/create_new_account.rs
@@ -8,6 +8,10 @@ use solana_program::{
 
 use crate::state::RentVault;
 
+// NOTE: this example does not restrict who may call it. A real rent vault
+// needs an authority check: an authority recorded at initialization with
+// seeds that bind the vault to one funder, or a per-caller limit. A bare
+// signer alone is not enough, since any keypair can sign for itself.
 pub fn create_new_account(program_id: &Pubkey, accounts: &[AccountInfo]) -> ProgramResult {
     let accounts_iter = &mut accounts.iter();
     let new_account = next_account_info(accounts_iter)?;
diff --git a/basics/pda-rent-payer/pinocchio/program/src/instructions/create_new_account.rs b/basics/pda-rent-payer/pinocchio/program/src/instructions/create_new_account.rs
index 7b65e3661..6a45c51c1 100644
--- a/basics/pda-rent-payer/pinocchio/program/src/instructions/create_new_account.rs
+++ b/basics/pda-rent-payer/pinocchio/program/src/instructions/create_new_account.rs
@@ -6,6 +6,10 @@ use pinocchio::{
 
 use crate::state::RentVault;
 
+// NOTE: this example does not restrict who may call it. A real rent vault
+// needs an authority check: an authority recorded at initialization with
+// seeds that bind the vault to one funder, or a per-caller limit. A bare
+// signer alone is not enough, since any keypair can sign for itself.
 pub fn create_new_account(
     program_id: &Address,
     accounts: &mut [AccountView],