No app goes public until its creator clicks Publish. In the paid account the researchers used, the next step offered 3 access settings: “Anyone with the link”, “Invited users” and “Only you”. “Anyone with the link” was already selected.

The setting matters because an app’s address does not stay secret, the researchers say. Opening an app makes the visitor’s computer look up its subdomain in DNS. Passive DNS services record such lookups, and anyone with an account can search those records by pattern.

Grok suggests 4 random words as each app’s name, and about half of the names the researchers found followed that pattern. Such names are hard to guess, but that does not protect an app whose name already sits in a searchable list.