[LeifCarrotson]

> Huh, so anyone who can access my web server can access the installation script?

"Obviously", the server should not be accessible from the public Internet while you're still doing setup. I assume it should still behind a firewall and you're accessing it by VPN. Only after you're happy with all the configuration and have the security locked down tight would you publish it to the world. Right?

[snickerdoodle12]

Obviously you should lock it down. I'm just going off these instructions and how they might be interpreted.