Just a warning for anyone wanting to try it: make sure to set up authentication first thing. Last time I checked, this was not obviously mentioned anywhere in the "Getting started" tutorial.

https://nodered.org/docs/security

By default, without auth setup, you're basically opening a friendly, public remote code execution web portal on a high TCP port. It's bound to all network interfaces (not just localhost as you would assume).