As far as I know, Syncthing’s local web interface is locked down by default. You should only be able to access it from localhost unless you change the settings. That said, there is some security concerns about JS in browsers making web requests to localhost, which is why I keep a password on Syncthing even though the webui isn’t remotely connectable.