OK, thanks for the solid answer. I suppose the core of my question was that pretty much: is it just as secure AND a less likely target than bitwarden. That makes a lot of sense to me. I would probably still worry about the strength of the code , though. Do we know if/how it's been audited?
I mean, your best having a look at the official Git but, i'd say, access/visibility is the most important.
Is it on your LAN/not open then even if it was less secure, it'd still be more secure if you know what I mean.
I host mine on a VPS but it's behind traefik with authelia (and 2FA). Plan is to get fail2ban setup over the next couple of evenings. SSH is cert only, probably going to change the port too but not sure if that's really necessary. I'm comfortable exposing on that basis.
I'm using PurelyMail with my own domain but frustratingly emails from my homelab are being blocked by apple.
I guess it's the reputation of my Domain? I've setup SPF, DKIM and DMARC but no dice.
I've (recently) started using Cloudflare for my nameservers so thinking about setting up their DMARK and possibly even move my Domain over to them from IONOS. If it makes any difference, who knows.