This question already has an answer here:
I am developing a REST API currently running off a node.js server. The API allows ethereum account creation, making a transaction etc.
The API interacts with a locally running ethereum node to execute these requests over RPC. I have set the provider to "127.0.0.1/8545" I use the web3.eth.personal RPC API for many of these requests. Is it safe to expose the personal API?
If not how could I unlock an account without web3.eth.personal.unlockAccount?