diff --git a/litellm/__init__.py b/litellm/__init__.py
index e45d926e8db..bbf738a6318 100644
--- a/litellm/__init__.py
+++ b/litellm/__init__.py
@@ -164,7 +164,7 @@ initialized_langfuse_clients: int = 0
 langfuse_default_tags: Optional[List[str]] = None
 langsmith_batch_size: Optional[int] = None
 prometheus_initialize_budget_metrics: Optional[bool] = False
-require_auth_for_metrics_endpoint: Optional[bool] = False
+require_auth_for_metrics_endpoint: Optional[bool] = True  # Security: Require auth by default (fixes #24530)
 argilla_batch_size: Optional[int] = None
 datadog_use_v1: Optional[bool] = False  # if you want to use v1 datadog logged payload.
 gcs_pub_sub_use_v1: Optional[
diff --git a/litellm/proxy/middleware/prometheus_auth_middleware.py b/litellm/proxy/middleware/prometheus_auth_middleware.py
index 5915e4aa07d..8c59a8fab72 100644
--- a/litellm/proxy/middleware/prometheus_auth_middleware.py
+++ b/litellm/proxy/middleware/prometheus_auth_middleware.py
@@ -18,13 +18,12 @@ class PrometheusAuthMiddleware:
     """
     Middleware to authenticate requests to the metrics endpoint.
 
-    By default, auth is not run on the metrics endpoint.
-
-    Enabled by setting the following in proxy_config.yaml:
+    By default, auth IS RUN on the metrics endpoint (secure by default).
 
+    To disable auth (not recommended for production):
     ```yaml
     litellm_settings:
-        require_auth_for_metrics_endpoint: true
+        require_auth_for_metrics_endpoint: false
     ```
     """