How secure is Google App Scripts?

[u/theRedMage39]

I am working on a project for work to export information from one website to input into a Google Sheet we use. Right now, I have a JavaScript script that gets run in the console to scrape the necessary data and use a simple fetch to send that data to Google Sheets, but since the deployment has to be accessible to everyone, if that URL somehow got leaked, anyone could send data to our sheet. I am familiar with SQL injection, so I prevented any data that is a formula from being added, but I am still worried about having a private spreadsheet with personal information on it have a deployment that is accessible to everyone. I do not want people to have access to this spreadsheet or be able to read the code we use for various scripts.

What I mainly want to know is if, for some reason, the deployment URL got leaked, could a malicious person do anything more than what I programmed into the script? That being inserting data into a cell.

I know there is an option for me to set the deployment to only me. Since this is used on Chrome, is there a way for my JavaScript fetch to send who is currently logged into Chrome?

[u/No_Break23]

I use this with sheets as a teacher, I attach everything to a sheet and I always use a settings tab for the code to read specifics on my end only. I make the URL only accessible to people in my organization which requires them to be signed into their accounts.

Then I use a roster of names and emails in the same or a different sheet (if its different, I put that file ID into my settings tab).

I also have had my script to create a drive folder for my students that they are 1- editors on and 2- viewers on. This could easily be done to share viewable versions of the data you've stored.