LeakyLinks: Public URL Scanners Can Expose Private Links
CISPA researchers found thousands of sensitive passwordless-login, document and booking links in public URL-scanning feeds, where the URL itself can act like a key.
The short version
What you need to know
- Researchers analysed public feeds from six prominent URL-scanning services and identified more than 4,000 links exposing sensitive personal information.
- Password-reset, magic-login, private-document and booking URLs can contain bearer tokens that grant access to whoever receives the complete link.
- A VPN cannot keep a token private after an email gateway, security integration or user submits the full URL to a public scanner.
What happened?
CISPA highlighted LeakyLinks research on 7 August showing that a security tool can create a privacy problem when it publishes a complete sensitive URL. The researchers examined public feeds from six major URL-scanning services, which are normally used to check links for phishing, malware or suspicious code.
After analysing more than two million URLs, the team identified more than 4,000 links exposing sensitive personal information, with reported precision of 97%. The examples included passwordless sign-ins, document-sharing links, booking records, visa documents and government documents. The paper does not name affected organisations.
Why a URL can behave like a password
Many reset, login, sharing and booking links contain a long token after the domain name. The service treats possession of that token as proof that the visitor is allowed in. If the full URL is copied into a public scanner, the scanner's feed can publish the key as well as the destination.
The researchers used honeypages to confirm that third parties visited links after scanner submission. They observed activity consistent with reconnaissance or opportunistic probing, but could not prove malicious intent. That distinction matters: the research demonstrates exposure and access, not that every visitor was a criminal.
What you can do now
Do not manually submit password-reset, magic-login, medical, booking or private-document links to a public URL scanner. If you need to investigate a suspicious message, scan the base domain or use an organisation-approved private analysis route without publishing the complete tokenised URL.
If a sensitive link may already have been submitted, invalidate it where possible: request a new reset link, revoke the share, sign out other sessions or contact the service. Providers should use short-lived, one-time tokens, require an additional authentication check for sensitive data and make likely private-link submissions non-public by default.
Where a VPN helps — and where it does not
A VPN can hide the user's source IP from many destinations and protect traffic on an untrusted local network. It may reduce one piece of network metadata visible during an ordinary visit.
A VPN cannot remove a bearer token from a URL, stop an email-security system from submitting that URL, make a public scanner feed private or revoke an exposed link. Once the secret is in the address itself, the remedy is link handling, access control and token invalidation—not a different network route.
VPN Rocks view
The safest mental model is simple: treat a private access URL like a temporary password. Do not paste it into a public service merely because that service has 'security' in its description.
Automated scanners also need privacy-aware defaults. The researchers estimate that filtering potentially sensitive links would still leave more than 99% of scanned URLs publicly available, suggesting that useful threat intelligence does not require publishing every possible secret.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
