You should probably remove this post fast and email support@chess.com
I found a very, VERY strange bug and I'm not sure how to go about reporting it.

This is an intended feature. On mobile, you can invite people by copying that friend.chess.com link and sending it to a friend. Upon opening the link, they can automatically friend you. there is actually no issue because you can't find a specific user's friend URL. You can only guess. There are also 5 letter ones like my own which I just got from the mobile app. It can still be abused though, as someone can just spam open a bunch of these links to get a massive amount of friends.
I am interested to know if these links expire with time or not. I remember using this feature in August and it gave me this link:
[edited]
Then the one I just got now is different but still works to friend me:
[edited]
I will remove these in a bit but this is indeed an intended feature. I'm fairly certain that these links only get created once a user makes use of the "Invite" feature on mobile. So no amount of guessing will ever automatically add Hikaru as a friend if he never uses that feature.

Just because it's an intended feature doesn't mean it can't simultaneously pose a security risk. That user may have created that link with the intention of one person using it, not with the intention of it lasting forever and potentially able to be found by anyone. I'm sorry this was in the wrong place, that's why I asked to be told if it was in my initial post. I was genuinely just trying to be helpful and share my findings
removed