What is it about?
Every day, millions of web links are submitted to security scanners, web archives, and other public repositories. Some of these URLs contain much more than a web address: they can include authentication tokens, password-reset links, payment-related information, personal details, or links to private documents. We studied more than six million publicly available URLs to understand how often this happens and what kinds of information can be exposed. We developed an automated system that examines URLs and their web content, including dynamically loaded pages, documents, and images, to identify potentially sensitive information that was unintentionally made public.
Featured Image
Photo by Towfiqu barbhuiya on Unsplash
Why is it important?
Our study found thousands of potential exposures, including authentication tokens, financial information, personal information, password-reset links, and publicly accessible document and e-signature workflows. The results highlight how sensitive information can unintentionally become public through URLs and show that even a small number of exposed links can create serious privacy and security risks.
Perspectives
What interested me most while working on *The Silent Spill* was the gap between how people often think about a URL and what a URL can actually reveal. A link may look private because it is long, random, or difficult to guess, but that does not make it protected. Our goal in this paper was not only to measure the problem, but also to show how these exposures can be detected before misuse. I hope this work encourages security platforms, developers, and organizations to treat URLs as potentially sensitive data and to design systems that do not rely on the obscurity of a link as a form of protection.
Tarek Ramadan
Read the Original
This page is a summary of: The Silent Spill: Measuring Sensitive Data Leaks Across Public URL Repositories, October 2026, ACM (Association for Computing Machinery),
DOI: 10.1145/3777912.3809151.
You can read the full text:
Contributors
The following have contributed to this page
