I have my Plex server in docker container that automatically restarts with the latest image once a week. I believe most vulnerabilities will come from outdated software.

Then I have nginx reverse proxying in front, I’m sure there’s additional safeguards I could throw in there but my instance is private.