Every time I used ngrok for quickly sharing my localhost site, I just prayed no bots finds it and start extracting.

I found a way to share localhost in a more controlled way where instead I have a invite only mechanism where I will manually approve or block the IP(s) that makes a request.

That's what Smuggl does, so you can smuggl your localhost to specific people rather than carrying it over the open world.