So I assume we are talking about a brute force attack here? And yes, as they URL of Limesurvey surveys are "predictable", I wouldn't be surprised when if after a huge amount of tries, a bot will guess the survey id and maybe also a token within the survey URL. Or am I understanding you wrong? If you feel, this is a security vulnerability, I highly recommend to not post this on the public accessible forum, but rather create a private bug report with as many information as possible on how to reproduce.
I answer at the LimeSurvey forum in my spare time, I'm not a LimeSurvey GmbH employee.
No support via private message.
