Is it safe to expose my Flask dev server to the public internet?

If you're just running it for yourself, you're likely okay with Tailscale. The main concern would be if your Tailscale account were compromised, allowing someone unauthorized access. It's smart to use SSH keys and possibly change the default SSH port for additional security.

There's a chance of memory leaks in Python apps, which could crash your server before anyone gets a chance to exploit it. Honestly, you should think about setting up a reverse proxy like Nginx or using an end-to-end solution like Cloudflare to shield your Flask app. Leaving Flask exposed isn’t advisable because it wasn’t designed for that.

You definitely shouldn't use Flask's development server for anything public. It's meant for local development and lacks the security and stability required for a production environment. Switching to something like Gunicorn is a much better choice. You can also set up Caddy in front of Gunicorn for added security and performance.

Tailscale protects you from exposure, so if it's just for personal use, keeping it within your Tailscale network is fine. However, always be cautious: exposing a web service means you could face potential vulnerabilities. Consider putting a firewall on your server to further minimize risks.