Yes, that's correct for my site currently. But what I had in mind is to have the invite code in the sheet itself and then when one submits, I check the entered code with the code in the sheet and then add/not add the rsvp.

However, due to timing constraints, I couldn't do this and instead used a simple encryption algorithm to have the hacker at least put in some effort to know the invite code :)

I will raise an issue on github for this.