Stateless form for editing records, have questions...

Hi all,
I have a form that contains listings for hundreds of worldwide groups in an organization, and I want to allow each group to update their own listing. I have read all the posts about having to rely on tons of Zoho user accounts, which I cannot realistically do since it would be a nightmare to manage the sharing and permissions for all those groups, not to mention their group officers change all the time.

So I have made a stateless form copy of the original form. I have added two scripted fields which when entered correctly bring up all the field data for the associated record. The two fields are the Zoho generated record ID and a Group ID which is assigned by me when the record is first created. The group has to know those two pieces of information in order to edit their listing.

The Group can make their edits and click the "Submit changes to Group" button, which will then update the associated record in the main form. What I don't know is how safe this will be and that is my question. My main form, the stateless form, and my views are all private (using access without login permalinks), and I am using the verification code to prevent spam as well as https. How easy would it be to obtain the Group ID and the Zoho record ID when everything is private? If someone really wanted to, could they exploit this somehow?

Thanks