Somebody can be sniffing your network and see what you send to that URL by POST or GET and define/guess the structure and do the same from another place...