Visnovo product / secure link previews

Copertina

Own the link, the destination and the way it appears when shared.

01 / Purpose

Purpose and scope.

A self-service short-link platform with custom Open Graph previews for channels such as LinkedIn, Slack and WhatsApp. It treats accounts, workspace isolation, redirect safety and mail delivery as part of the product rather than incidental plumbing.

Owned by Visnovo. I develop and maintain it.

Create short links with a chosen cover and title/description drawn from destination-page metadata.

Keep links isolated by workspace and resolve short codes within the correct host.

Support email-first account access without weakening sensitive account operations.

Prevent the preview and redirect surfaces from becoming unrestricted server-side fetch tools.

02 / Interactive demo

Copertina: give a link its cover.

Enter a sample destination, generate its preview, choose a cover and create a short code. Search or reopen your saved sample links to compare their covers.

About this demoAn interactive local preview using fictional data, embedded in this portfolio. A reconstruction of the three-column link creator. Page metadata and covers come from fixed examples; sample links do not navigate or redirect. Changes reset when you reload.

Copertina / Local workspace reconstruction · fictional data

Copertina.A cover for every link.Sample workspace

Your links

Choose a saved link to inspect its cover and metadata.

Filter recent links

2 of 2 sample links

Saved in memory for this visit. Reset or reload clears your changes.

Create a link

Choose the destination. Give it a cover.

Cover preview

1200 × 630

Fictional studioA cover for every link

Your destination

Your link title appears here

Generate a preview to load the sample page’s title and description.

Waiting for metadata

Titles and descriptions come from destination metadata. A custom cover changes the image; the destination stays the same.

Reconstructed from Copertina’s creator and recent-links workflow. Metadata is bundled sample content, and covers are CSS artwork. No URL fetch, file upload, account, email or server operation occurs.

03 / Decisions

Engineering decisions.

Host-scoped lookup

A short code is resolved inside its workspace/domain boundary instead of becoming globally ambiguous.

HTTPS destinations only

Redirect flexibility should not quietly expand into unsafe protocols or internal-network access.

Mail fails closed

An account operation that depends on an emailed code should stop when delivery is not proven.

Two production datastores

SQLite keeps local development simple while PDO preserves a deliberate MariaDB/MySQL production path.

04 / Architecture

How it works.

Authenticate

An email-first account combines a password with a delivered login code for a deliberate second step.

Compose

Inside the account’s workspace, the user chooses an HTTPS destination, optional custom code and cover. The destination supplies the title and description.

Validate

Server-side destination and preview handling enforce narrow protocols and fetch protections.

Resolve

The incoming host and short code select the isolated record, serve the preview surface and continue to the destination.

05 / Technology

The working parts.

PHP 8.1+PDOSQLiteMySQL / MariaDBSMTPHTMLCSSJavaScript

06 / Project status & roadmap

Current state and next steps.

Current

The application has substantial working account, workspace and short-link flows.
The PHP/PDO model supports SQLite locally and MySQL-compatible production storage.
Core destination, workspace and account-security boundaries are implemented.
A fix for login and reset code expiry times was deployed in September 2026.

Planned

Custom workspace domains.
Richer workspace roles and management controls.
Complete edit and delete workflows.
More abuse prevention and end-to-end checks of production email.