"We're working on a release soon that puts a password on the JSON-RPC interface, but until then, avoid using the -server switch, and don't web browse on the same machine where bitcoind is running." Who's the "we" Satoshi was talking about?
https://twitter.com/pete_rizzo_/status/1813637298933633038