Currently,

1. Anyone on a machine running IPFS can access the IPFS API over the HTTP interface. This means any user can, e.g., read any running daemon's private keys.
2. Anyone on a machine can run an IPFS server on the standard IPFS port and the IPFS client will blindly use it. This means that a malicious user could impersonate the IPFS server.

Solutions:

1. Use unix domain sockets. The daemon could expose the API over one or more unix domain sockets. If multiple sockets are used, administrators could control access to various APIs using standard unix permissions (this doesn't require multiple sockets but that might make implementation easier).
2. Use HTTP authentication and store some API key in the IPFS directory. With this method, care must be taken to authenticate both ways.