Try Open QlikView Document in the action instead of opening via URL. Note that in this case the target document must have the fields which selections you want to pass, else the target document will be open with whatever selections was last saved.
Alternatively, you can use Bookmarks, which although will be visible in the URL, they will look like
which does not provide any hint on what actually "BM25" stores.
On a different note, for QlikView, URLs with certain parameters are accepted by design. If you don't want it to work that way, you will need to introduce rewrite rules in the web server to avoid users to use parameters in URLs.
Additionally, if security is well in place by whatever folder and file permissions must be applied, and with the use of Section Access, no user will be able to see data they shouldn't see even if they know how to create a URL with these parameters.