It’s just important to note that if a run parameter is added, it should not be used if the same-site cookie is set to None (or Disabled and the browser defines None as the default).
If the same-site is none, you could enter some other site and they could make a http GET request, in the same way that CSRF is exploited, although this would not be a CSRF vulnerability per se, but they could execute some really expensive instructions in the data explorer.
The same-site cookie policy is relatively new, but the major browsers already support it for some time, Chrome defaults to Lax, and Discourse too (if I’m not wrong), so it should not be a problem in most cases.