Actually the other instances don’t pull content. You push it out instead. Basically if you don’t run pict-rs and you don’t allow user registreations, you’re safe for everything except potential copyright infringement from some text someone might post. If you make your webui inaccessible to anyone but your IP, you protect against even that.