If you haven’t been given a direct URL, don’t go snooping