The server validates your owner key before it returns any application. The key stays in this browser tab only. Closing the tab removes it.
This URL alone is not access. A server-side check protects the data. Applicant PII is never public.