diff --git a/lib/Controller/EpisodesController.php b/lib/Controller/EpisodesController.php
index 8a47a6d..c4e97d3 100644
--- a/lib/Controller/EpisodesController.php
+++ b/lib/Controller/EpisodesController.php
@@ -27,6 +27,10 @@ class EpisodesController extends Controller
 		parent::__construct(Application::APP_ID, $request);
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function list(string $url): JSONResponse {
 		$client = $this->clientService->newClient();
 		$feed = $client->get($url);
@@ -37,6 +41,10 @@ class EpisodesController extends Controller
 		return new JSONResponse($episodes, $feed->getStatusCode());
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function action(string $url): JSONResponse {
 		$action = $this->episodeActionRepository->findByEpisodeUrl($url, $this->userService->getUserUID());
 
diff --git a/lib/Controller/PodcastController.php b/lib/Controller/PodcastController.php
index c7c5528..fb3a26e 100644
--- a/lib/Controller/PodcastController.php
+++ b/lib/Controller/PodcastController.php
@@ -22,6 +22,10 @@ class PodcastController extends Controller
 		parent::__construct(Application::APP_ID, $request);
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function index(string $url): JSONResponse {
 		try {
 			$podcast = $this->podcastDataReader->tryGetCachedPodcastData($url);
diff --git a/lib/Controller/SearchController.php b/lib/Controller/SearchController.php
index 1b42821..d0a388a 100644
--- a/lib/Controller/SearchController.php
+++ b/lib/Controller/SearchController.php
@@ -19,6 +19,10 @@ class SearchController extends Controller
 		parent::__construct(Application::APP_ID, $request);
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function index(string $q): JSONResponse {
 		return new JSONResponse($this->multiPodService->search($q));
 	}
diff --git a/lib/Controller/ToplistController.php b/lib/Controller/ToplistController.php
index 28bef13..161cb6b 100644
--- a/lib/Controller/ToplistController.php
+++ b/lib/Controller/ToplistController.php
@@ -19,10 +19,18 @@ class ToplistController extends Controller
 		parent::__construct(Application::APP_ID, $request);
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function hot(): JSONResponse {
 		return new JSONResponse($this->fyydService->hot());
 	}
 
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 */
 	public function new(): JSONResponse {
 		return new JSONResponse($this->fyydService->latest());
 	}