diff --git a/cloud/app.py b/cloud/app.py
index b908e91..d1bade8 100644
--- a/cloud/app.py
+++ b/cloud/app.py
@@ -461,6 +461,15 @@ def telemetry():
 @app.route('/api/security/cve-audit', methods=['POST', 'GET'])
 def run_cve_audit():
     """Protected endpoint triggered by Node-RED using REST API + API Key."""
+    # Only node-red is allowed in this endpoint
+    if g.device_id != "node-red":
+        return jsonify({
+            "@odata.error": {
+                "code": "403",
+                "message": "Forbidden: Not allowed to trigger CVE audit"
+            }
+        }), 403
+    
     audit_results = shodan_auditor.audit_server_vulnerabilities()
     
     inserted = cve_audit_results.insert_one({