Hi...you could investigate Firejail, application sandboxing (in the event of weakness forestalls access outside program need).
On Mobian I have Firetools, Firejail arrangement Wizard and it loads for simple design of projects you need to securely sandbox.
I use ssh to make Pinephone organization/commandline undertakings from the PC snappy/helpful. To make it safer/distant to pariahs I made my Pinephone ssh worker Tor concealed assistance .onion access as it were