# How to Categorize and Prevent Risks of Sensitive Links in URLScan

[Tinder](https://yomu.fyi/company/tinder) · Tinder · Nov 7, 2022

**Type:** Problem & solution

## Summary

Security integrations with URLScan can accidentally index sensitive links when API calls are executed with public visibility. Tinder Security Labs constructed targeted queries to uncover exposed links across file-sharing services, enterprise ticketing platforms, and single sign-on portals. Investigations revealed that exposed links included document magic links containing contracts and bank details, as well as active new-hire registration links that allowed attackers to complete registration workflows and configure two-factor authentication. In one SSO query alone, researchers discovered 1,300 indexed invitation links, with 20 to 50 new links appearing daily. The researchers collaborated with URLScan to purge the exposed indexes from public searches and advised organizations to configure security scanning tools to use private or unlisted visibility settings.

## Context

Enterprise security tools and automated integrations frequently submit scanned URLs to URLScan with public visibility, unintentionally exposing sensitive documents, ticketing systems, and account invitation links.

## Approach / What changed

Researchers formulated specific search queries to detect exposed links, evaluated the security impact across SaaS tools, shared findings with URLScan to purge public indexes, and outlined visibility setting mitigations for email security integrations.

## Takeaways

- Security tools forwarding automated scans to URLScan with public visibility can unintentionally index sensitive links, magic URLs, and invitation tokens.
- Publicly indexed single sign-on and ticketing invitation links allow malicious actors to complete user registration, configure two-factor authentication, and access corporate resources.
- Organizations can mitigate exposure risks by configuring automated URLScan integrations to private or unlisted visibility and reporting existing sensitive scans for removal.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Incident Response](https://yomu.fyi/topic/incident-response), [Privacy](https://yomu.fyi/topic/privacy)

[Read original post](https://medium.com/tinder/how-to-categorize-and-prevent-risks-of-sensitive-links-in-urlscan-d6cd0a58b0da)