I have it as an unprivileged container behind a reverse proxy and HTTPS/HSTS. I know it’s not perfect but I keep backups of important shit and monitor things regularly.