I'm certain that someday I'm going to be dinged on a really shallow kind of work security test because I decided to investigate a link into a sandbox/honeypot environment.
It could be kinda-secure if the header had to have a payload which matched a certain value pre-approved for a time-period. However an insider threat could see the test going on and then launch their own campaign during the validity window.