Security
A URL shortener is attractive to attackers precisely because it hides a destination behind a domain people trust. This page lists the controls that exist in the code today — and stops there.
Controls
Each one is a mechanism, not an intention.
Every request is served over TLS, including customer domains.
HSTS is sent on every response with a two-year max-age, includeSubDomains and preload, so a browser that has seen the site once refuses to talk to it over plain HTTP again. Custom domains are served over TLS too; certificate issuance and renewal are handled by the hosting platform the operator deploys to.
bcrypt at cost 12, for account passwords and link passwords alike.
Plaintext passwords are never written anywhere — not to the database, not to logs. Verification against a missing hash still burns the same amount of time as a real comparison, so response latency does not reveal whether an account exists.
Stored as a SHA-256 digest. The key itself is shown exactly once.
We cannot show you a key again because we do not have it — only its hash, which is what an incoming request is matched against. Keys carry explicit scopes and an optional expiry date, and can be revoked immediately.
Every server-side fetch resolves DNS and checks the address before connecting.
A hostname check alone is not enough: an attacker controls their own DNS and can point a public name at a cloud metadata address. Each A and AAAA record is resolved and rejected if it lands in a private, loopback, link-local or CGNAT range, and the check runs again on every redirect hop.
Short links cannot be pointed at internal infrastructure.
Destinations are rejected when they use a non-HTTP protocol, embed credentials, target a private or loopback address — including decimal, octal, hexadecimal and IPv4-mapped IPv6 encodings — or use a port that is not a plausible public web service.
Blocklist, structural heuristics and optional Safe Browsing.
Destinations are checked against an operator blocklist, then against heuristics that look for brand names in unrelated paths and subdomains, credential-harvest vocabulary, punycode homographs and chained shorteners. Where an operator configures a key, Google Safe Browsing runs as a third layer. Heuristics mostly produce a warning interstitial; only the blocklist and Safe Browsing hard-block.
Sliding-window limits on every sensitive endpoint.
Sign-in, registration, password reset, link-password entry, abuse reports, the contact form and the public API each have their own bucket, so pressure on one never consumes another’s allowance. Responses carry standard rate-limit headers, and the limiter fails open rather than locking customers out if the cache blips.
Every state change a customer could later ask about is recorded.
The log stores the actor, the action, the target and what changed. It is what answers “who changed this destination and when” — including for team accounts, where more than one person can edit the same link.
Admin, Editor and Viewer roles, re-checked on every request.
Ownership is part of the database query rather than a comparison made after fetching a row, so a guessed id returns nothing rather than someone else’s data. Administrative role is refreshed from the database periodically instead of being trusted from a long-lived token.
The analytics table has no column for an IP address.
An address is used in memory to derive a daily-rotating visitor hash and to apply rate limits, then discarded. Nothing that is stored can be turned back into it.
Headers
These are the values configured for the application, not a generic list.
A Content-Security-Policy is not listed because the framework injects inline bootstrap scripts, which would force 'unsafe-inline' on script-src and make the directive weaker than it looks. XSS defence rests on React's escaping and on server-side sanitisation of the one surface that accepts customer HTML.
Design constraint
The feature that serves another origin under a branded URL is gated structurally rather than by a checkbox.
go.acme.com may proxy store.acme.com; it may not proxy anything under a different one.Because rule 2 compares registrable domains, “proxy a bank's login page” is not one misconfiguration away — it cannot be expressed. Any destination outside your own registrable domain uses an ordinary HTTP redirect, which shows the visitor where they are going.
Honesty
Trust pages usually end with a row of badges. This one does not, because the badges would not be real.
There is no SOC 2 report, no ISO 27001 certificate and no third-party penetration test to point at. Claiming one would be false, and a security page that opens with a lie is worth less than no security page at all.
What is above is verifiable: it describes controls that exist in the running code. If your procurement process needs a questionnaire completed, write to [email protected] and it will be answered accurately, including where the answer is “not yet”.
Responsible disclosure
Good-faith security research is welcome. Here is exactly how to report, what is in scope, and what we commit to in return.
Email [email protected] with a description of the issue, the steps to reproduce it, and the impact you believe it has. A short proof of concept helps more than a scanner export.
Research conducted in good faith and within this policy is authorised. We will not initiate or support legal action against you for it, we will not report you to law enforcement for it, and we will not terminate your account for accessing your own test data in the course of it.
If a third party brings action against you for research that followed this policy, we will make it known that your activity was authorised. This is not legal advice and does not override the law where you are — if you are unsure whether something is permitted, ask first.
There is no paid bounty programme. We would rather say so plainly than imply one and disappoint you after you have done the work.
A malicious link someone else created is an abuse report, not a vulnerability — use the report form so it reaches the queue that can disable it quickly.