[khoap1220-hue]

Linked issue: trivial
Refs #671

Summary

• Add a clear SECURITY NOTE doc comment above create_new_account / process_create_new_account across all three basics/pda-rent-payer implementations (anchor, native, and pinocchio).
• Clarify that the example intentionally omits a caller authority check for brevity, so anyone invoking the instruction could drain lamports from the rent_vault PDA unless production code verifies an authorized signer and compares its key against a stored admin/funder pubkey (in addition to the general account validation checks shown in basics/checking-accounts).

AI disclosure

• No AI tooling was used
• AI tooling was used
  Tool and extent: Assisted in drafting the security note comment wording across the Anchor, Native, and Pinocchio examples; manually reviewed and verified against the program source files.

[github-actions]

Every commit in a Solana Foundation repository needs signature verification, and these are unverified:

• 620d3a4 docs(pda-rent-payer): add caller authority check note to Anchor flavor (#671)
• bd85a58 docs(pda-rent-payer): add caller and new_account check note to Native flavor (#671)
• 4137b86 docs(pda-rent-payer): add caller and new_account check note to Pinocchio flavor (#671)

Set up signing, then sign the existing commits (git rebase --exec 'git commit --amend --no-edit -S' main) and force-push. This review is dismissed automatically once every commit verifies.

[github-actions]

Hi @khoap1220-hue,

Thanks for the pull request. We ask that every change references an issue a maintainer has accepted, and there isn't one linked here.

These examples are a teaching resource and each one has to stay small enough to read in one sitting, so whether a new example or framework flavor belongs here is worth settling before anyone writes it. Agreeing on the approach in an issue first means nobody writes code that can't be merged. See CONTRIBUTING.md for the full workflow.

Please open an issue describing the change, or comment on the existing one. Once a maintainer has labelled it accepted, put Fixes #<issue> in this description and reopen this pull request; the check runs again and clears itself. Typos, broken links and comment-only fixes are exempt: write Linked issue: trivial instead.

[greptile-apps]

Confidence Score: 4/5

[Low impact] The change reaches only the teaching notes for three rent-payer examples.

The PR appears safe to merge, with a non-blocking correction to the authority-check reference.

Findings

1.  Link lacks authority checks ▶

Summary

Adds caller-authority warnings to the Anchor, native, and Pinocchio rent-vault examples. No executable code changes.

• The rent-payer examples explain who can call them and which checks a real vault needs.

_{Reviews (1) · Last reviewed commit: "docs(pda-rent-payer): add caller and new..." · Reviewed by Greptile}

[greptile-apps]

Link lacks authority checks

basics/checking-accounts shows signer, owner, initialization, and program checks. It does not compare a signer with a saved admin or funder, so readers following this link will not find the authority check the note recommends. Point to an example that checks that relationship, or describe this reference as account checks only. The same wording appears in the native and Pinocchio notes.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!