Security, Safe Browsing & Bot Defense

URL shorteners are frequent targets for spammers seeking to disguise phishing URLs, malware downloads, or brand-impersonation campaigns. A single malicious link can destroy a branded domain's email deliverability and search engine reputation overnight.

Shaf employs a defense-in-depth security model across multiple layers.

Defense Layers Overview

Rendering diagram...

Layer 1: Automated Safe Browsing Inspection

When a new destination URL is submitted via console or API, Shaf performs a multi-source threat check before the link is created:

Cloudflare DNS Threat Intelligence

The destination domain is queried against Cloudflare's Security DNS resolver, which maintains threat intelligence feeds from multiple security vendors and incident response data.

Google Safe Browsing

Target URLs are checked against Google's Safe Browsing dataset — the industry standard threat list covering malware hosts, phishing pages, and unwanted software distributors used by Chrome, Safari, and Firefox.

If a target is flagged as malware, phishing, or adult content, link creation is blocked immediately with a 403 MALICIOUS_URL error. The check runs in under 50ms and does not impact normal link creation latency.

Layer 2: Cloudflare Turnstile Bot Defense

Automated bot networks frequently attempt:

Brute-force slug generation — systematically resolving millions of random slugs to discover private links
Link scraping — harvesting all short links from a domain for competitor intelligence
Spam injection — submitting thousands of malicious links via the public API

Shaf integrates Cloudflare Turnstile — a privacy-preserving CAPTCHA alternative:

Mechanism	Traditional CAPTCHA	Cloudflare Turnstile
User Friction	Solve distorted text	Zero visible challenge for humans
Privacy	Often sends fingerprints to third parties	No PII collected; browser attestation only
Bot Detection Method	Visual puzzle solving	ML-based browser signal analysis
False Positive Rate	High (blocks legitimate users)	Very low

Turnstile tokens are validated on public forms and unauthenticated API interactions before any processing begins.

Layer 3: Cloudflare WAF & DDoS Protection

All traffic to Shaf domains — including tenant custom domains — benefits from:

DDoS mitigation: Automatic absorption of volumetric attacks at Cloudflare's Anycast network level, before traffic reaches Shaf Workers.
Web Application Firewall (WAF): Rule-based blocking of common attack patterns (SQL injection, XSS, path traversal) against the Shaf console and API endpoints.
Rate limiting: Per-IP and per-API-key request throttling to prevent abuse by high-frequency scrapers.

Layer 4: Password Protection & Link Expiration

At the link resolution layer:

Password-gated links halt the redirect and issue a browser challenge before the destination URL is ever revealed to the visitor. The destination URL is never exposed in the HTML source or browser dev tools until the correct passphrase is entered.
Expired links return a redirect to the configured fallback URL or an expired notice — the destination is never served after the expiry timestamp.

Layer 5: Referrer Policy & Link Cloaking

For marketers protecting proprietary sales funnels and affiliate arrangements:

Referrer Stripping

Shaf can cloak intermediate referrers using standard Referrer-Policy: no-referrer HTTP headers. The destination server sees the request as direct traffic, preventing competitors from reverse-engineering your funnel structure.

Password HMAC Sessions

Password-protected link sessions are validated using HMAC-SHA256 signed cookies — stateless session tokens that cannot be forged. Unauthorized scrapers probing destination URLs will only receive the password challenge page.

Reporting Abuse

If you encounter a Shaf short link being used for phishing, malware distribution, or spam:

Report it directly at shaf.app/report.
Include the full short link URL and a brief description of the harmful content.
Our trust & safety team reviews all reports and takes action within 2 business hours for critical phishing and malware reports.

Links found to violate our Acceptable Use Policy are immediately suspended and the associated organization is notified.

Ask AI about this page