collectd agents can expose metrics endpoints and forward to multiple backends.
- Enable only required plugins.
- Restrict network listener plugins to trusted interfaces.
- Use signed/encrypted transport plugins where possible.
- Protect credentials for downstream metrics backends.
- Use TLS for remote write targets.
- Limit output destinations by network policy.