Custom post type support would be great, your concern about exposing private data, for example a WooCommerce order, which is a post is relevant.

A pretty safe bet would be to respect the public flag of the post type object. You can get all public post types, like this $post_types = get_post_types( [ 'public' => true ]);

Let me know if you have questions about developing this plugin. WordPress plugin development is what I do.