Comment by antoniomika

Correct! The tunnels are protected using ssh auth as well, so you can ensure that only the users you want to access it can.