I switched to Kuma recently, but it's not all roses either. Their Docker image is based on Debian 10 with Go 1.19 and they don't feel the need to update because "OS level bugs are seldomely exploitable"

https://github.com/louislam/uptime-kuma/issues/4885

So host it on a separate machine and don't put any secrets in there

I use Cloudflare zero trust to secure it.