That's true, but it seems pretty low-risk to me, since only Stripe and maybe a few other services you're integrating with actually know the DNS name. It's possi

That's true, but it seems pretty low-risk to me, since only Stripe and maybe a few other services you're integrating with actually know the DNS name. It's possible someone could discover it and attack it, but I think I'd wait to see an attack actually happen that couldn't practically be mitigated otherwise before moving it behind Cloudflare etc.