What if someone forwards my private link?

Treat it as a boundary break: revoke or renew the link, tell your intended recipients, and reset expectations for future shares.