Setting up Stockfish on a server

[Jon12345]

Not sure how an untrusted FEN could do anything. Doesn't it just get processed for an evaluation?

[hgm]

You could send it garbage input designed to make the engine crash, and do specific unwanted things. (Such as sending your bank statements to someone else.) This is a favorite hacker method: send a program some input that it is not designed to handle but will naively except (e.g. a very long message, which overruns the reserved input buffer, and then writes stuff in memory locations where it controls later behavior of the program).

When using connect.exe as a server you are supposed to be protected against that by getting no access to Stockfish unless you give the correct password. But as it doesn't use a https connection, I suppose it would in theory be possible for people to eavesdrop on your password.