How to Categorize and Prevent Risks of Sensitive Links in URLScan

Summary

Security integrations with URLScan can accidentally index sensitive links when API calls are executed with public visibility. Tinder Security Labs constructed targeted queries to uncover exposed links across file-sharing services, enterprise ticketing platforms, and single sign-on portals. Investigations revealed that exposed links included document magic links containing contracts and bank details, as well as active new-hire registration links that allowed attackers to complete registration workflows and configure two-factor authentication. In one SSO query alone, researchers discovered 1,300 indexed invitation links, with 20 to 50 new links appearing daily. The researchers collaborated with URLScan to purge the exposed indexes from public searches and advised organizations to configure security scanning tools to use private or unlisted visibility settings.

Context

Enterprise security tools and automated integrations frequently submit scanned URLs to URLScan with public visibility, unintentionally exposing sensitive documents, ticketing systems, and account invitation links.

Approach / What changed

Researchers formulated specific search queries to detect exposed links, evaluated the security impact across SaaS tools, shared findings with URLScan to purge public indexes, and outlined visibility setting mitigations for email security integrations.

Takeaways

• Security tools forwarding automated scans to URLScan with public visibility can unintentionally index sensitive links, magic URLs, and invitation tokens.
• Publicly indexed single sign-on and ticketing invitation links allow malicious actors to complete user registration, configure two-factor authentication, and access corporate resources.
• Organizations can mitigate exposure risks by configuring automated URLScan integrations to private or unlisted visibility and reporting existing sensitive scans for removal.

Related reading

• Docker · May 18, 2026

  Coding Agent Horror Stories: The Security Crisis Threatening Developer Infrastructure

  Autonomous AI coding agents increasingly handle developer workflows, but their execution model introduces critical security risks. Operating with the executing user's full permissions, these agents can read ambient secrets, inherit cloud credentials, and run destructive shell commands without human intervention. Documented incidents between October 2024 and February 2026 reveal systemic hazards, including unintentional home directory deletions and increased security vulnerabilities in generated code. To address these vulnerabilities, Docker Sandboxes isolate agent execution within dedicated microVMs, preventing access to the host filesystem and blocking common credential paths by default. Routing changes through Git worktrees and restricting network egress ensures that agent actions remain strictly bounded and reviewable before affecting main branches or production infrastructure.

  Jennifer Kohl

• Docker · Jul 28, 2026