found the bad URL leak