Public server mode

I whitelisted just the calls needed by UI in public server mode. I am really new to this project, so it would be great if someone could check the security of running this open on the web.