URL leakage is the unintended exposure of sensitive data through a web address, redirect chain, or link generated by a system. It often happens when tokens, email addresses, file identifiers, or query parameters are placed in the URL instead of being kept in headers, cookies, or server-side state. Because URLs are copied into browser history, logs, analytics, bookmarks, and referrer headers, leaked values can spread far beyond the original request.
In cyber security, URL leakage matters because it can reveal private records, session tokens, internal paths, or workflow details to attackers and third parties. In real attacks, an agent, app, or script may follow a link, open a redirect, or transmit a URL to another service and accidentally disclose data. Defenders reduce the risk by avoiding sensitive data in URLs, validating redirects, stripping secrets from logs, using short-lived tokens, and reviewing how automated tools handle navigation and sharing.