Hello! I have a question about potential community vulnerabilities exposed via the guest user. As far as I understand, Salesforce doesn't advise against either (1) allowing guest users in Aura communities to log cases via quick actions (example: https://help.salesforce.com/s/articleView?id=000381881&type=1) or (2) using sharing rules for guest users (https://help.salesforce.com/s/articleView?id=sf.security_sharing_rules_guest.htm&type=5).
Having a quick action to log a case means that the guest user profile must have Read and Create access to cases. In combination with the sharing rule, this level of access allows savvy-enough guest users to use aura calls to gain visibility into cases submitted by other users: https://www.varonis.com/blog/abusing-salesforce-communities
For example, in my community, guest users need to view a handful of case fields (Case #, Status, Submitted Date, etc.) in a public list view. Since the sharing model for cases in Private on my org, I allow guest users Read-Only access to cases of a certain record type via a sharing rule. Guest users also need to be able to submit cases using a custom quick action, in order to request access to the community, since we don't allow self-registration.
The quick action includes such sensitive fields as the requestor's full name, workplace, work phone, email, and address. So the guest user needs read and edit access to those fields. Once cases are submitted, they are not visible in the UI. However, due to the level of access given through the sharing rule and the profile, cases can be accessed via Aura calls, as described in the article above. If I delete the sharing rule, case data cannot be scraped off the site, but then cases can no longer be visible to guest users in the public list view.
Does Salesforce offer a way to prevent guest users from accessing cases via Aura calls when using a New Case quick action and when sharing rules are implemented? If there is no way to lock this access, what is recommended as best practice: what configuration should be used when guest users need both the ability to log cases and view limited case data, but should not have the "backdoor" access to information from cases submitted by other guest users?
Thank you in advance!
Manoj Nambirajan (Dell Technologies) 
Forum Ambassador
@Ksenia Choate wonder if we can build a lightning web component which is embed in communities and displays the necessary Case records in admin context.
This could replace the sharing rule for record type you have created?
