Another issue we identified is that you can find those "hidden" admin panel or URLs that shouldn't be known to the outside, by just refreshing the page a few times and checking all requests.

It is not a best practice, but some companies do and it makes easier for those to be found.

thanks,