I also want to make sure that people connecting can ONLY access jellyfin. And I keep hearing about its own security flaws.

I don’t trust people connecting to themselves not be compromised by someone else, for one thing.