This question already has an answer here:
I have a Google Sheet that is shared via URL. It's a list of events. I wrote a script that syncs the list to a shared Google Calendar. The script has an installable on-edit trigger to update the calendar with new information. The script is therefore authorized to edit my calendars.
As stated here,
Installable triggers always run under the account of the person who created them.
Given this is the case, it seems that anyone with the shared link can edit my script to do whatever they want with my calendars. This seems like an inherent security issue in any shared file that has a triggered script with an authorization. Is there any way to prevent this? Am I missing something?