Firewall it to localhost and access it over an SSH tunnel.

The author of this project should have a little section on how to do this. I'm sure lots of people would love the convenience but worry about security.

There's already documentation for how to do that in a zillion other places though, I don't think every project needs to regurgitate those instructions.

They can mention that it's possible and link to resources explaining how to do it. That way, people that didn't know it's a possibility can learn and apply it.

I understand your thoughts completely. They are awesome projects, but I could never imagine hosting this on a production server open to the word.

Use nginx to password protect the path!

Still really paranoid about using something like this in production.