Yes, it’s secure. By default, when creating a shortcode, a unique upload directory name will be generated and suggested to be used. Of course you can change it, but we suggest to use unique random strings as upload directory names. Download links are generated randomly and comes with unique key/hash.