public forms but only private views

how do I implement this. Otherwise anyone could guess the view urls and get a copy of the database records.