What I am actually defending against by self-hosting, what I accept instead, and why a written threat model stops scope creep in the lab.