What a truly, truly, truly absurd statement. I run my own webserver and have Roundcube exposed. It's only accessible via my VPN and even then, it's HTTPS. So tell me, how are you planning to compromise that?
In fairness, if it's only accessible via VPN then your Roundcube instance is not part of the web.