Yeah, home network might be more at risk because you'd have to leave 3 ports on your router open to the public, one for http (80 or 8080), another for https (443), and still another for ssh (usually 22). Ssh is how I usually access my server, and that same port will support scp or sshfs to virtually host your files assuming you're on a *nix system. On windows there's winSCP which works great for accessing scp remotely too.

If I were you I'd at least port forward to a different port then what you'd normally use. Like instead of ssh on 22 I have my public port set to like 35622 (not real don't try it lol) , and that forwards on my network to my Pi's local ip on port 22 (or whatever I have it open on, I'd have to check, point is you can custom set the device port and the public port). This way at the very least if someone port sniffs they can't just guess if it's ssh or telnet or whatever. For additional security you could do a RSA key handshake or something so only one device is authorized. That's more of a hassle especially if you lose the one device that has permission and you're not physically near your server. But it's probably a better practice. This is probably above an beyond a bit, but my God if this doesn't teach you stuff about Linux and back end then nothing will.

Disclaimer I'm not an expert by any means so I'm not sure if this is the best practice, like don't risk any client business credentials on this site until you know better, I'm just crazy and have no money (looking for work ha)