Why bother? Block WAN access at the router, put the entire thing behind a VPN (Tailscale or Wireguard, dealers choice), and move on. If you really care, put everything you vibe code or consider security-abandonware on its own VLAN.

Keep it off the WAN and you'll be streets ahead of commercial vendors, and your weird, one-off, vibe-coded app means those same commercial vendors are the easier, more widely-deployed targets anyways.

Could do something like oauth to gmail + OTP (or passkeys) on cloudflare workers with long lived sessions or I could vibe code an iOS app even and side load it. That would be very secure as well. I haven't decided yet.

I have a personal password manager secured like that I vibe coded to replace 1password and so far it is working great.