Comment by AndyMcConachie

If your security depends on someone not walking your DNS zone, you're doing something wrong.

If your security depends on someone not guessing a URL, shortened or not, you're doing something wrong.