Researchers scanned 6.09 million public URLs and found 12,331 potential sensitive-data leaks, including 26 live password-reset links and 62 non-expiring JWTs
The authors built an automated detection system combining lexical URL filtering, dynamic rendering, OCR-based extraction, and content classification, applied it to 6,094,475 public URLs collected from VirusTotal, URLScan.io, Hybrid Analysis, the Wayback Machine, and RedHunt paste sites, and identified 12,331 potential exposures across authentication, financial, personal, and document-related categories, including 26 live password-reset links, 83 API keys, 12 publicly accessible e-signature workflows, 7 fully visible 2FA backup codes, and 62 JWTs lacking expiration constraints.