What would be the recommended way of securely passing a record's internal id as a parameter? We're customizing our emails that are sent to customers with a quote attached. The goal is to add a button/link to the email body that says "Order These Items" which on click will redirect them to a custom form (a suitelet, I suppose) with a list of all the items on the quote, pulled from the internal id that was originally passed into email.

I'd probably use a guid that is stored in the quote besides the internal id

Good idea, I'll try that. Thank you.