The answer for this one is the zero trust platform, use it to restrict only what you want to allow in email or ip address. Just make sure that the machine that is hosting the service isn’t exposing outside of cloudflare.
Edit: Also make sure you are backing up remember 3-2-1 for your backups.
You had best be glad is was unmarked. If he tripped and rolled a 1 no one would have ever seen this picture.