The client itself is likely to be more secure than other reverse proxy CLI's as it is inside your browser sandbox. CLI's have access to all your files.

You would take the same precautions as putting any other web server on the web - you might want to use a password or a hard to guess subdomain if you do not want others to access it. But I would assume you would be using test data in your dev environment.

The Cloudflare WAF (Web Application Firewall) also blocks requests to your web server. I think that is just DDOS protection.