Comment by mattewong

Maybe better if the website discloses the fact that file names are getting tracked via POST to the server