I've built a simple web app Flask.io that enables users to create and share to-do lists.
It doesn't require sign up. This is an important differentiator. I don't want to force the user to register for a tool they haven't used yet.
How it works is when they create a list, a random slug is generated and they are redirected to that unique url e.g. flask.io/random-slug
My question is what security implications are there?
Removing sign up should improve the on-boarding UX, but is it worth it in exchange for a not as secure system, and should I introduce registration further down the flow?
The random slug is 5 characters long. Would love to know your feedback especially if any experience here.