> it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL Unless a service is leaking or spidering the URL into a public

> it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL Unless a service is leaking or spidering the URL into a public index. https://positive.security/blog/urlscan-data-leaks https://positive.security/blog/urlscan-data-leaks https://arstechnica.com/information-technology/2014/05/dropbox-disables-old-shared-links-after-tax-returns-end-up-on-gooogle/ https://arstechnica.com/information-technology/2014/05/dropb... https://security.stackexchange.com/questions/239762/how-are-hidden-private-urls-being-leaked-to-third-parties https://security.stackexchange.com/questions/239762/how-are-...