Can someone guess a PDF submission url and gain access to it?

I realise that I can link directly to a submission's PDF using the following URL

http://www.jotform.com/pdf-submission/{id}

or 

https://www.jotform.com/pdf-submission/{id}

This seems really rather insecure to me, I could brute force guess a bunch of IDs to get a load of personal data? Should there not be a bit more security on this?

Security is very important to us.
Submissions IDs are made of a combination of 18 digits and this provides a very strong protection as it is virtually impossible to break a code of 18 digits. 

To break a code of only 4 digits you can have 10.000 different combinations. So even though it may not seem secure an 18 digits number provides a very strong protection. You just need to take care not to share the submissions ID, but as long as they are safe, you can feel safe. As stated before it is virtually impossible to break this code.

Let us know if we can assist you further.   

Thanks for the response. I assume that is also the case for the reports link https://www.jotform.com/excel/{reportId} although I can add a password to that I can see.

Is there a link to get a submission as a CSV?

e.g. http://www.jotform.com/csv-submission/{id}

When generating your CSV report you will be able to get the submission id, as shown below:

After clicking on Continue button, the next screen will show the Open Report field the link of the CSV report.

Let us know if we can further assist you.

Sorry I meant is there a URL for just a singular submission (not all of them).

No, there is no such feature for formats other than PDF at this time.

This feature is only available for PDF of your submissions, similarly how at this time you can only attach a PDF file or add a PDF link of your submission to Email Notifications.

Please let us know if you need further clarifications regarding PDF submissions, or kindly open a new thread for any other questions, we will be happy to help.