We are setting up a public Communities page. This page will publish a flow to capture leads but the flow must have read access to Account and another custom object to do its job. Communities requires records be shared with the specific Guest User account in order for the Flow to have access to those records and now fail due to lack of access.
My question is if the records are shared via Sharing Rules with the Guest user, can calls be made to the Salesforce API in any way to access this shared data without a Salesforce username and password or other method of user authentication?
Are there any other security risks I may be overlooking?