Hey Akash. You highlighted the security risks very well in the blog and I feel whenever the security aspect comes on a plate, it gets the bare minimum attention unless some major attack impacts the system. Since you have mentioned sensitive URLs in the Direct Insecure Object References part, I was relating to one of the concerns which is preventing the users from posting phishing/vulnerable links. Unless you get a notification that this is a vulnerable link, it gets clicks. This is very common when products allow communication among the user's Eg. forums, communities, chatting applications etc.

Generating Link Previews can be one of the possible solutions, especially when the preview shows a vulnerable alert, that would eventually prevent a user from clicking the link. Our approach (within my team) has been to help in this direction by creating an API that extracts metadata from URLs and therefore ensures secure link sharing. Here’s a blog ( https://apyhub.com/blog/secure-link-preview ) where we discussed the issue in some more detail. Would be super curious to hear your thoughts.

Cheers,

Sohail