Web services that need to be setup from a web frontend with no required token or credentials always make me nervous for this reason.

All it takes is someone noticing the port and beating you to the punch, and then it’s their server.