A tunnel makes the server reachable from the internet. Only requests with your secret key get through, but anyone who has the full address can control Blockbench and read and write files at any path ...