[Official FAQ] Corrections and follow-up questions welcome.

Tunnels expose an internal service via a hostname without opening broadband ports—handy for demos and personal remote access. Abuse and auth are still your problem.

Do:

• Enforce access policies (SSO/OTP)—do not let the world burn your GPU anonymously.
• Review privacy implications for sensitive prompts flowing through a third party.
• Monitor tunnel health and configure timeouts for long generations.

Fine for personal/small-team use; treat public production separately.