Honestly, URLs are a potentially massive threat vector themselves.

Are the urls associated with individual users either directly or in a bucketed fashion? Seems like no to the former but the release leaves a lot to be desired.