Why do you presume that web app has to be run public? You can easily limit access to web app by IP, or you can put it on a private network that you will access

Why do you presume that web app has to be run public? You can easily limit access to web app by IP, or you can put it on a private network that you will access through VPN. That would make it more secure than most web services that we trust regularly, like gmail or paypal...