The AEM 6.5 security checklist: https://experienceleague.adobe.com/docs/experience-manager-65/administering/security/security-checkl...
And for making the AEM instance public: There is nothing really special, you can follow any documentation which describes how to make internet services public.
A piece of advice: Even test instance require a proper setup and security; if you don't have experience with this, I highly suggest to get in touch with someone who has done that before.
For making the AEM instance public, I've been trying to find out how to publish the .JAR instance (the quickstart.jar file) to the internet. It looks like I need to convert it into a .WAR file and use Tomcat + IIS. Otherwise I haven't found great results. Can you recommend platforms that I can look to?
I appreciate a link to the security checklist.
You can use tools like localtunnel  / ngrok  to expose your localhost over the internet. But be careful as it's easy to exploit localhost due to lake of security. Make sure to apply security checklist