I notice the hosted form is accessed with a URL similar to:
http://www.appnitro.com/demo/view.php?id=6
A user can potentially fill out other forms (some sensitive) by changing the id in the URL. Can view.php be called with POST instead of GET?
Or, what about using a GUID type number for the forms? It would be a lot harder to guess '1032-AE80-107362788158787616-A732' than '6'