|Anything a user's program can do, a user can do. |
One option would be to create a client/server setup, where after validation, the server retrieves and sends the data to the client. This needs to be done with a real programming language (not VBS).
Another option is to deny "List folder" to the folder holding the documents. This will prevent enumeration of the folder, and if done correctly, allows access to the files, assuming you know the name. The down side? Your script needs to know what the names are without looking at the files.
How To Ask Questions The Smart Way