diff --git a/litellm/integrations/prometheus.py b/litellm/integrations/prometheus.py
index 5e630ab2558..f4a922c7a3c 100644
--- a/litellm/integrations/prometheus.py
+++ b/litellm/integrations/prometheus.py
@@ -3418,11 +3418,10 @@ class PrometheusLogger(CustomLogger):
     @staticmethod
     def _mount_metrics_endpoint():
         """
-        Mount the Prometheus metrics endpoint with optional authentication.
+        Mount the Prometheus metrics endpoint with authentication.
 
-        Args:
-            require_auth (bool, optional): Whether to require authentication for the metrics endpoint.
-                                        Defaults to False.
+        Authentication is enabled by default (require_auth_for_metrics_endpoint: True).
+        Set 'require_auth_for_metrics_endpoint: false' in litellm_settings to disable.
         """
         from prometheus_client import make_asgi_app
 
@@ -3449,9 +3448,16 @@ class PrometheusLogger(CustomLogger):
 
         # Mount the metrics app to the app
         app.mount("/metrics", metrics_app)
-        verbose_proxy_logger.debug(
-            "Starting Prometheus Metrics on /metrics (no authentication)"
-        )
+
+        # Log based on authentication status
+        if litellm.require_auth_for_metrics_endpoint:
+            verbose_proxy_logger.debug(
+                "Starting Prometheus Metrics on /metrics (authentication required)"
+            )
+        else:
+            verbose_proxy_logger.debug(
+                "Starting Prometheus Metrics on /metrics (authentication disabled)"
+            )
 
 
 def prometheus_label_factory(
diff --git a/litellm/types/integrations/prometheus.py b/litellm/types/integrations/prometheus.py
index 33ce05525f0..8d720ef569d 100644
--- a/litellm/types/integrations/prometheus.py
+++ b/litellm/types/integrations/prometheus.py
@@ -351,14 +351,15 @@ class PrometheusMetricLabels:
         UserAPIKeyLabelNames.API_KEY_ALIAS.value,
         UserAPIKeyLabelNames.REQUESTED_MODEL.value,
         UserAPIKeyLabelNames.TEAM.value,
-        UserAPIKeyLabelNames.TEAM_ALIAS.value,
+        # Security: Removed PII labels (fixes #24530)
+        # UserAPIKeyLabelNames.TEAM_ALIAS.value,  # Contains company names and employee emails
         UserAPIKeyLabelNames.USER.value,
-        UserAPIKeyLabelNames.USER_EMAIL.value,
+        # UserAPIKeyLabelNames.USER_EMAIL.value,  # Contains email addresses
         UserAPIKeyLabelNames.EXCEPTION_STATUS.value,
         UserAPIKeyLabelNames.EXCEPTION_CLASS.value,
         UserAPIKeyLabelNames.ROUTE.value,
-        UserAPIKeyLabelNames.CLIENT_IP.value,
-        UserAPIKeyLabelNames.USER_AGENT.value,
+        # UserAPIKeyLabelNames.CLIENT_IP.value,  # Contains client IP addresses
+        # UserAPIKeyLabelNames.USER_AGENT.value,  # Contains workflow IDs and infrastructure info
         UserAPIKeyLabelNames.MODEL_ID.value,
     ]