Added security note for scheduled tables and added missing sender_auth to ReducerContext doc

Author: JasonAtClockwork

docs/docs/00400-tables/00500-scheduled-tables.md

@@ -59,7 +59,7 @@ public static void SendReminder(ReducerContext ctx, Reminder reminder)
 <TabItem value="typescript" label="TypeScript">
 
 ```typescript
-const Reminder = table(
+const reminder = table(
   { name: 'reminder', scheduled: 'send_reminder' },
   {
     scheduled_id: t.u64().primaryKey().autoInc(),
@@ -68,7 +68,7 @@ const Reminder = table(
   }
 );
 
-spacetimedb.reducer('send_reminder', { arg: Reminder.rowType }, (_ctx, { arg }) => {
+spacetimedb.reducer('send_reminder', { arg: reminder.rowType }, (_ctx, { arg }) => {
   // Invoked automatically by the scheduler
   // arg.message, arg.scheduled_at, arg.scheduled_id
 });
@@ -84,6 +84,56 @@ spacetimedb.reducer('send_reminder', { arg: Reminder.rowType }, (_ctx, { arg })
 3. **When the time arrives**, the specified reducer/procedure is automatically called with the row as a parameter
 4. **The row is typically deleted** or updated by the reducer after processing
 
+## Security Considerations
+
+:::warning Scheduled Reducers Are Callable by Clients
+Scheduled reducers are normal reducers that can also be invoked by external clients. If a scheduled reducer should only execute via the scheduler, add authentication checks.
+:::
+
+<Tabs groupId="server-language" queryString>
+<TabItem value="rust" label="Rust">
+
+```rust
+#[spacetimedb::reducer]
+fn send_reminder(ctx: &ReducerContext, reminder: Reminder) -> Result<(), String> {
+    if !ctx.sender_auth().is_internal() {
+        return Err("This reducer can only be called by the scheduler".to_string());
+    }
+    // Process the scheduled reminder
+    Ok(())
+}
+```
+
+</TabItem>
+<TabItem value="csharp" label="C#">
+
+```csharp
+[SpacetimeDB.Reducer()]
+public static void SendReminder(ReducerContext ctx, Reminder reminder)
+{
+    if (!ctx.SenderAuth.IsInternal)
+    {
+        throw new Exception("This reducer can only be called by the scheduler");
+    }
+    // Process the scheduled reminder
+}
+```
+
+</TabItem>
+<TabItem value="typescript" label="TypeScript">
+
+```typescript
+spacetimedb.reducer('send_reminder', { arg: Reminder.rowType }, (ctx, { arg }) => {
+  if (!ctx.senderAuth.isInternal) {
+    throw new SenderError('This reducer can only be called by the scheduler');
+  }
+  // Process the scheduled reminder
+});
+```
+
+</TabItem>
+</Tabs>
+
 ## Use Cases
 
 - **Reminders and notifications** - Schedule messages to be sent at specific times

docs/docs/00500-functions/00200-reducers/00300-reducer-context.md

@@ -319,14 +319,15 @@ spacetimedb.reducer('send_reminder', { arg: scheduledTask.rowType }, (ctx, { arg
 - `identity() -> Identity` - Get the module's identity
 - `rng() -> &StdbRng` - Get the random number generator
 - `random<T>() -> T` - Generate a single random value
-- `sender_auth() -> &AuthCtx` - Get authorization context for the caller
+- `sender_auth() -> &AuthCtx` - Get authorization context for the caller (includes JWT claims and internal call detection)
 </TabItem>
 <TabItem value="csharp" label="C#">
 
 | Property       | Type                  | Description                                     |
 | -------------- | --------------------- | ----------------------------------------------- |
 | `Db`           | `DbView`              | Access to the module's database tables          |
 | `Sender`       | `Identity`            | Identity of the caller                          |
+| `SenderAuth`   | `AuthCtx`             | Authorization context for the caller (includes JWT claims and internal call detection) |
 | `ConnectionId` | `ConnectionId?`       | Connection ID of the caller, if available       |
 | `Timestamp`    | `Timestamp`           | Time when the reducer was invoked               |
 | `Rng`          | `Random`              | Random number generator                         |
@@ -338,6 +339,7 @@ spacetimedb.reducer('send_reminder', { arg: scheduledTask.rowType }, (ctx, { arg
 | -------------- | -------------------------- | ----------------------------------------------- |
 | `db`           | `DbView`                   | Access to the module's database tables          |
 | `sender`       | `Identity`                 | Identity of the caller                          |
+| `senderAuth`   | `AuthCtx`                  | Authorization context for the caller (includes JWT claims and internal call detection) |
 | `connectionId` | `ConnectionId \| undefined`| Connection ID of the caller, if available       |
 | `timestamp`    | `Timestamp`                | Time when the reducer was invoked               |