# In Pi

Set up the VNC server to accept connection from `127.0.0.1` only. This IP address always refer to the computer (in this case the Pi) itself. No device other than the Pi can access the VNC server.

Set up `ssh` server. For maximum security enable public key based login in `ssh` and disable password based login.

# In Laptop

Set up `ssh` tunneling to the Pi in your VNC client software like Remmina. 

# Bonus Point

If you don't need to access the internet from both the Pi and the laptop, disable WiFi in both and use an Ethernet cable to connect the two. 

Since neither the Pi nor the laptop has a DHCP server installed, you will need to assign static IP addresses to both of them. 

Hope this helps