I could access a registry by guessing an ID (an ActiveRecord primary key, so just an integer), not searching for names. Agreed, this isn't very useful, but the

I could access a registry by guessing an ID (an ActiveRecord primary key, so just an integer), not searching for names. Agreed, this isn't very useful, but the list isn't protected/obscured if the URLs are that easy to guess. For example, at Amazon Universal Wishlist, the ID of a valid wishlist is very hard to guess -- like 6HV8XSTGDT3E7-difficult. On top, you can select whether you want that list to be public (discoverable via name search), visible if one knows the link, or private.