The leak is the very first step: the /shows page.
So the problem isn't who we're reaching. It's what happens after the click.