Isaia-Arknet_PTY_LTD if the provider offers Block backups for the VM, pay for the service as you will not regret it.
And make sure to test restoring said backups at least once before going live. Some VPS providers do a very poor job at this if the server is powered on during the backup. In my experience and others here, Linode & Heztner are reliable. If you can take the backup image and restore to another VPS its great for testing but some providers don't let you do this and you just have to hope the backup isn't corrupted.
There are a few bugs that relate to trying to do something too soon after creating a site or adding a role. For example trying to add a website to a server with the role added 30 seconds ago. Wait a few minutes and there isn't an issue. Might just be an issue on slower servers.
On lower end servers the installation can seem like its hanging at 98% ish. Even if CPU usage is low, it is working, just wait. I recommend running the installation inside screen. Otherwise if you lose connection to SSH the installation won't finish.
There is no server or website security out of the box. You have to take care of kernel updates, security related to SSH, ports, linux hardening etc. The only security is isolation between sites.
Make sure whatever firewall you use doesn't block any ports to/from the control panel server.
Don't put the control panel behind any CDN.
