In order to prevent unauthorized access to information, a system may analyze and may selectively store the information provided based on requests from users that are not unauthorized to access the information. In particular, the system may receive a request for information associated with a document (such as a web page) from an authorized user, either in real-time (i.e., during live or online operation of the system) or offline (in which case the system may operate as a proxy for a live feed of requests). In response, the system may provide or replay the request, but may include the credentials of an unauthorized user. Then, the system may analyze the response to the request to determine if the response is substantive (i.e., includes information). If yes, the system may store the response for use in subsequent analysis and to guide remedial action.