I wonder why most substrate nodes have that --unsafe-rpc-external flag and which of the calls are actually unsafe. Is there a RPC documentation somewhere?
These flags allow you to expose the RPC interfaces publicly:
--unsafe-rpc-external Listen to all RPC interfaces. Same as `--rpc-external`.
--rpc-external Listen to all RPC interfaces. Default is local. Note: not all RPC methods are safe to be exposed publicly. Use an RPC proxy server to filter out dangerous methods. More details: <https://docs.substrate.io/v3/runtime/custom-rpcs/#public-rpcs>. Use `--unsafe-rpc-external` to suppress the warning if you understand the risks.
By default, the node will refuse to start if you try to expose an RPC interface and run a validator node at the same time. The --unsafe-* flags allow you to suppress this security measure. Exposing RPC interfaces can open up a huge surface of attacks and has to be carefully reviewed.