As RushWallet does not store URLs, wallet details, or funds in any centralized servers, there is no way for us or any malicious user to generate or "guess" your RushWallet's custom URL.
That said, RushWallet is still in beta and is not recommended or intended for storing large amounts of ETH. Any user who gains access to your URL - either through remote access to your bookmarks, or any form of public data storage - will be able to access your wallet. The password-protection option helps as an additional safeguard, but please take steps to ensure that you retain exclusive access to your URL and do not share it with any third parties.
Our current wallet platform, Jaxx, is out of beta and is more fully-featured than RushWallet. Download it here.