Once you have exported your receipts to Xero, you can access the images by clicking on a button "Go to Shoeboxed".
This button leads you to the source image through a very complex URL identification. Some people may ask the question "Does well hidden means secure?"

Indeed, there is a strong negative connotation with security through obscurity.  However, consider that use of a password is also a form of security through obscurity (only you know the password).  In fact, random URL generation is arguably a more secure method than password since most people will re-use the same password across multiple sites to aid memorisation.  There is a useful discussion of this here -https://stackoverflow.com/questions/12479398/how-can-i-generate-a-private-url-with-state-of-the-art-balance-between-securit

We have made a specific decision to make use of a private sharing URL, and have implemented additional security measures to detect brute force attacks and guessing of links.  Note that Xero uses a similar method when you send an invoice link to a client, and for a lot of businesses that link is going to contain bank details so that customers can pay you.