I’ve mine on a separate VLAN that has no internet access. the only thing it is allowed to do is sending and receiving UDP packets on port 14447/14449 for hyperionLED. And that’s about as smart as I allow it to be.