[khoap1220-hue]

Linked issue: trivial
Refs #671

Summary

• Add a clear SECURITY NOTE doc comment above create_new_account / process_create_new_account across all three basics/pda-rent-payer implementations (anchor, native, and pinocchio).
• Clarify that the example intentionally omits a caller authority check for brevity, so anyone invoking the instruction could drain lamports from the rent_vault PDA unless production code verifies an authorized signer and compares its key against a stored admin/funder pubkey (in addition to the general account validation checks shown in basics/checking-accounts).

AI disclosure

• No AI tooling was used
• AI tooling was used
  Tool and extent: Assisted in drafting the security note comment wording across the Anchor, Native, and Pinocchio examples; manually reviewed and verified against the program source files.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation-only change appears safe to merge.

Summary

Adds a security note above Anchor’s create_new_account.

• The Anchor example now warns that any caller can spend from its rent vault.

_{Reviews (1) · Last reviewed commit: "docs(pda-rent-payer): add caller authori..." · Reviewed by Greptile}