Produce a sentence which has a cefr level of "b1" and keywords: web, application, history, number, urls.
That browsing history might contain any number of URLs to pages within your web application, allowing the attacker to now map out large chunks of your web application's UI without ever even visiting your site.