I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to visit a particular URL and supply a (very long) query string parameter.
How safe is this?
It feels like it should be rather safe, at least for such a limited admin page. There are no password forms to enter the query string, and no public web pages that link to this URL, so nothing to draw the attention of a possible attacker.
What mostly worries me is that Google might pick up on the URL if I visit it in Chrome, and possibly start linking to it in one place or another. Not sure if they do such a thing (yet) though.