That strongly depends on the routing design of the web application. I could easily design a bad url-path that dicloses information that should be kept private...