Thank you for feedback! Theoretically it's possible, but it's not just digits, it's alphanumeric so the chance is very low. As another user suggested - I will add approval for new clients so it's not going to happen
Unless you have some sort of throttling implemented, that's not really a lot and could probably be brute forced.
Hope you figure it out though!