This work introduces security for unsourced random access (URA) via a physical-layer security approach. To achieve confidentiality, the proposed system opportunistically exploits intrinsic features of feedback-aided URA without altering its original structure or operational characteristics. As a result, the system preserves URA's efficiency, including low delay and minimal signaling overhead, while ensuring secure communication. To secure transmission, each user generates a secret key from a feedback signal broadcast by the BS in a previous transmission round, which depends on the BS-user channel and can thus be treated as private. Each user then encrypts its data using the secret key before transmission. Along with the encrypted data, only the parity bits of the LDPC-encoded key are transmitted, enabling secret key recovery at the legitimate receiver via Slepian-Wolf decoding with side information. We propose a receiver algorithm to recover both the encrypted data and the encoded secret key at the legitimate receiver. We further present a theoretical analysis to derive analytical error probabilities for both the legitimate receiver and the passive eavesdropper, as well as to quantify the additional load imposed by the security measures on the URA system. It is shown, based on both theoretical analysis and simulation results, that meaningful secrecy is achieved with only negligible extra overhead compared to the standard URA system.