If the suitelet is being called from a web app, someone could easily get the URL and the parameters and call your suitelet