[ireadmevs]

Yes, a link requires user interaction. But what if the attacker decides to render an image instead and put the secret data in the query params? Loading an image is a way to trigger a request without user interaction

[javxfps]

I actually ended up doing that to see if they would change their mind, but they didn't really seem to care.