We never expose an order from an enumerable order number alone.
Use the private token from your order confirmation. An order number alone cannot open tracking.