I am very paranoid. I have:

a) password
b) stripped html interface going to item "f"
c) http commands disabled
d) xml interface disabled
e) . and .. disabled
f) a mirrored symlink tree (mirrordb)

Like I said, I don't expect any malicious attacks. But I have had my playlists changed on me when listening, and had a few unexpected reboots and disk syncs (non-trivial amount of time), so I take precautions...