diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
index 14a2a71..6e8fea1 100644
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -3,3 +3,7 @@ name: "JsonApiToolkit CodeQL"
 paths-ignore:
   - "**/bin/**"
   - "**/obj/**"
+  # Localhost-only contract-test fixture with in-memory seeded data.
+  # Not deployed and not a usage showcase, so auth alerts on it are noise.
+  # Authentication and authorization belong to the consuming application.
+  - "samples/ContractApi/**"
diff --git a/docs/security.md b/docs/security.md
index fce8630..14e0518 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -5,6 +5,9 @@ Guidance for using JsonApiToolkit safely: restricting includes, configuring quer
 > [!NOTE]
 > To **report a vulnerability** in JsonApiToolkit itself, see the [Security Policy](https://github.com/intility/json-api-toolkit/blob/main/SECURITY.md). This page is about using the toolkit securely.
 
+> [!NOTE]
+> JsonApiToolkit does not perform authentication or authorization. It builds queries and serializes responses inside your controllers. Protecting endpoints with `[Authorize]`, policies, and per-resource ownership checks is the responsibility of the consuming application.
+
 ## `[AllowedIncludes]`
 
 Without `[AllowedIncludes]`, every navigation property on your entities is includable via `?include=`. That can leak sensitive relationships and run expensive queries. The attribute restricts which relationships clients can request.