WatchNexus includes multiple security layers: TOTP 2FA, IP filtering, rate limiting on authentication endpoints, audit logging, and session management. The Tunnel module also provides built-in WireGuard VPN management, so you can access your server securely without port forwarding. That said, we always recommend placing any self-hosted application behind a reverse proxy (Nginx, Caddy, Traefik) with HTTPS.