Should I vibe code
Branded short links with server-side click tracking and conversion attribution back to ad platforms
An open redirect you built yourself is a phishing kit with your brand on the envelope.
?
Their verdict, the Starter price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Branded short links plus click tracking means you are running a redirector that logs people. Both halves attract abuse, and the tracking half is personal data whether you meant it to be or not.
What actually breaks
not "if". the specific failures.
- An unauthenticated create endpoint, which turns your branded domain into a phishing vector with your reputation on the envelope
- Every link ever shared, permanently, if the domain lapses or the service stops — printed ones cannot be edited
- Click logs, which are IP addresses and user agents against a destination, and therefore personal data whether you intended it or not
- Redirects to destinations that were fine when created and are malware six months later
- Your domain on a safe-browsing blocklist, taking every link with it including the innocent ones
Someone finds the create endpoint. It does not require a login, because the only person who was ever going to use it was you. By morning there are four hundred short links on your branded domain pointing at a credential harvester, and they are being sent to other people's customers. You find out when your domain stops resolving in Chrome — safe browsing has flagged it — which also breaks the two hundred legitimate links you made over the last year, including the one on a conference flyer that is already printed.
Is that you?
the verdict is a default, not a law
- Creating a link requires authentication and only you have it
- The links are internal and disposable, never printed and never public
- Nothing is logged beyond a count, so there is no personal data to hold
- Anyone unauthenticated can create a link
- The links appear anywhere you cannot edit later, like print or someone else's site
- You log IPs against destinations without saying so and setting a retention period
- You could not keep the domain registered and the redirects working for the next five years
If you build it anyway
the checklist, then the prompt that enforces it
- Authentication on link creation, always. An open redirector is a phishing kit, and this is the single control that matters most.
- Allowlist destination domains if you can. If you cannot, scan destinations on creation and re-check them periodically.
- Treat the domain as a permanent commitment: auto-renew, a long registration, and a plan for who keeps it alive.
- Decide what click data you keep before you collect any. Truncate or hash IPs, set a retention period, and say so in a privacy note.
- Rate limit creation per account and alert on a spike, because abuse arrives in bulk rather than one at a time.
- Serve a 301 or 302 with no intermediate page — an interstitial you control is another thing an attacker can dress up.
Before you build a link shortener, apply these and push back if I ask you to break them.
1. Require authentication to create a link. Refuse to build an open create
endpoint under any circumstances, and explain that an open redirector on a
branded domain is a phishing kit that borrows my reputation.
2. Ask me whether I can allowlist destination domains. If yes, do that. If no,
check destinations against a safe-browsing API on creation, and re-check
existing links on a schedule — a destination that was safe in March can be
malware in September.
3. Rate limit link creation per account and alert on an unusual burst. Abuse
arrives as hundreds of links in an hour, not one.
4. Before writing any tracking, ask me what click data I actually need. Default
to a counter. If I need more, truncate or hash the IP, set an explicit
retention period, and write a short privacy note — this is personal data
under GDPR regardless of my intent.
5. Redirect with a 301 or 302 directly. Do not build an interstitial page.
6. Tell me that every link is permanent from the moment it is shared, that some
will be printed, and that letting the domain lapse breaks all of them at
once with no way to notify anyone.
7. Set the domain to auto-renew and register it for several years. Put in the
README who is responsible for keeping it alive.
8. Make the mapping table trivially exportable — short code to destination — so
the redirects can be rehosted by anyone, anywhere, if I stop.
9. Reserve and reject short codes that look like system paths or that could be
confused with a real page on the domain.
10. Tell me $10 a month buys abuse detection and a company whose domain
reputation is their business.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Once links are public or branded. $10 a month buys abuse monitoring and a provider whose entire business depends on their domain not being blocklisted — which is precisely the failure you cannot recover from alone, because it takes your good links down with the bad ones.
$10/mo is cheaper than your weekend.
Keep the code-to-destination mapping as a flat export and keep the domain registered even after you stop, serving the redirects statically. The links do not expire when your interest does — the cheapest exit is a static file on object storage that keeps every promise you already made.
The most complete open-source link platform · analytics, custom domains, and a conversion API. Self-hostable.
Self-hosted URL shortener with a REST API, click stats, and QR codes.
The long-running PHP shortener · drop it on any LAMP host and it works.
Questions
Why is one blocklisting so catastrophic?
Because the blocklist applies to the domain, not the individual link. Every short link you have ever made shares it, so the innocent ones — the one in your email signature, the one on a printed flyer — stop working at the same moment. Delisting takes time you do not control, and the printed ones cannot be updated at all.
Are click logs really personal data?
An IP address is treated as personal data under GDPR, and paired with a destination URL it says something about an identifiable person's behaviour. That does not make it forbidden — it makes it something you need a reason to collect, a retention period for, and a note about. A plain counter avoids the question entirely.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Counting page views without cookies is a POST and a table. This one you should own.
It’s a static page with links on it. If you’re paying $9 a month for this, we need to talk.
Self-hosting analytics is the one case where doing it yourself is also the privacy-correct answer.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice