Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.
If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?
**I should have mentioned that my app has a requirement whereby certain number of users (multiple, i.e. Manager, Approver and Director) will require access to a particular item to help in the approval process.