Your orders. The order and invoice URLs take a guessable numeric id with no ownership check - other tenants' orders (e.g. #1001) are one increment away.