Create short links whose preview title, description and image are deliberately controlled.
Independent / secure link previews
Copertina
Own the link, the destination and the way it appears when shared.
01 / Purpose
A tool with a reason to exist.
A self-service short-link platform with custom Open Graph previews for channels such as LinkedIn, Slack and WhatsApp. It treats accounts, workspace isolation, redirect safety and mail delivery as part of the product rather than incidental plumbing.
Keep links isolated by workspace and resolve short codes within the correct host.
Support email-first account access without weakening sensitive account operations.
Prevent the preview and redirect surfaces from becoming unrestricted server-side fetch tools.
02 / Decisions
The interesting part is why.
Host-scoped lookup
A short code is resolved inside its workspace/domain boundary instead of becoming globally ambiguous.
HTTPS destinations only
Redirect flexibility should not quietly expand into unsafe protocols or internal-network access.
Mail fails closed
An account operation that depends on an emailed code should stop when delivery is not proven.
Two production datastores
SQLite keeps local development simple while PDO preserves a deliberate MariaDB/MySQL production path.
03 / Architecture
A deliberate path through the system.
Authenticate
An email-first account combines a password with a delivered login code for a deliberate second step.
→Compose
The user chooses a workspace, HTTPS destination and the metadata that should appear when the link is shared.
→Validate
Server-side destination and preview handling enforce narrow protocols and fetch protections.
→Resolve
The incoming host and short code select the isolated record, serve the preview surface and continue to the destination.
04 / Technology
The working parts.
PHP 8.1+PDOSQLiteMySQL / MariaDBSMTPHTMLCSSJavaScript
05 / State & roadmap
What is real now—and what comes next.
- The application has substantial working account, workspace and short-link flows.
- The PHP/PDO model supports SQLite locally and MySQL-compatible production storage.
- Core destination, workspace and account-security boundaries are implemented.
- Production SMTP and complete account-flow acceptance remain to be proven.
- Custom workspace domains.
- Richer workspace roles and management controls.
- Complete edit and delete workflows.
- Additional abuse prevention and production mail verification.