Well it seems you'd have to not only guess the file name, but also the 5 character code; as it appears its uppercase, lower and numbers, which is ~916 million possibilities

...although on second thought, and with some bad math, if you know the file name, and you can manage 750+ tries a second, you could brute it prior to the 14 day expiration.

Stop complaining and encrypt your stuff. You're the one making absurd requests to a fine small nice service here.

gpg2 --armor --output my-file.tar.gz.gpg -e my-file.tar.gz && curl --upload-file ./my-file.tar.gz.gpg https://transfer.sh

I'd think the ability to set the file to delete after X downloads instead of 14 days would be useful.

At risk of asking a naive question, what's wrong with just using a Dropbox or rsync?