Why bother? Block WAN access at the router, put the entire thing behind a VPN (Tailscale or Wireguard, dealers choice), and move on. If you really care, put everything you vibe code or consider security-abandonware on its own VLAN.
Keep it off the WAN and you'll be streets ahead of commercial vendors, and your weird, one-off, vibe-coded app means those same commercial vendors are the easier, more widely-deployed targets anyways.
Keep it off the WAN and you'll be streets ahead of commercial vendors, and your weird, one-off, vibe-coded app means those same commercial vendors are the easier, more widely-deployed targets anyways.