been messing with self-hosted VPNs for a couple years, and honestly, security's always a cat and mouse game. i used to think just setting strong creds was enough but then learned social engineering and misconfigurations are where most ppl get burned. gotta stay alert and keep those configs tight, ymmv.