Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?