Firewall it to localhost and access it over an SSH tunnel.
The author of this project should have a little section on how to do this. I'm sure lots of people would love the convenience but worry about security.
There's already documentation for how to do that in a zillion other places though, I don't think every project needs to regurgitate those instructions.
They can mention that it's possible and link to resources explaining how to do it. That way, people that didn't know it's a possibility can learn and apply it.
I understand your thoughts completely. They are awesome projects, but I could never imagine hosting this on a production server open to the word.
Use nginx to password protect the path!
Still really paranoid about using something like this in production.