Every Link Is a Promise: Our Stance on Fraud and Reputation

A link shortener is a strange kind of trust exercise. When someone scans a QR code on a menu or clicks xxsml.com/joes-pizza, they're not really trusting Joe's Pizza — they're trusting us, for the half-second between the tap and the redirect, to have sent them somewhere real. Every shortener carries this same risk: the moment one gets used for phishing or malware, it doesn't just burn that one link, it makes people suspicious of every link with that domain in front of it. That's other businesses' links too, not just the bad one.

So this is where we actually stand, and what's actually built, not just promised.

Every link is checked before it exists

When a link is created or its destination is changed, xxsml checks it before accepting it — not after:

• Only http:// and https:// destinations. No javascript:, no data:, nothing that isn't a normal web page.
• No embedded credentials in the URL (the user:pass@host pattern), which has no legitimate use here.
• The destination's hostname has to actually resolve, and it can't resolve to a private, loopback, or otherwise internal address. A link can't be used to quietly probe or reach something on someone's internal network.

If a submission fails any of these, it's rejected outright — the link is never created. This part runs synchronously, every time, no exceptions.

Reputation checking is a real layer, built to grow

Beyond the checks above, every new link — and every time an existing link's destination changes — goes through a reputation check in the background. Here's the honest part: xxsml doesn't have a live third-party threat-intelligence subscription wired in yet, so today that check doesn't have external data to compare against. What it does have is the plumbing fully built: a link that a future check flags gets marked and handled differently, automatically, with no code changes needed the day a real threat-intel backend gets connected. We'd rather tell you exactly what's real today than imply protection that isn't active yet.

Flagged links don't just silently redirect

If a link is ever flagged, the person scanning it doesn't get bounced straight through. They land on a plain warning page first, showing exactly where the link actually goes — with the real destination domain shown bold and large, specifically so it's legible to someone who isn't reading URLs carefully, not just to whoever built the system. They can still choose to continue. Nothing gets silently swapped out from under them.

Every destination change is on the record

This one's specific to how QR codes actually get used: a code goes on a window decal or a printed flyer, and it sits there for months or years. The link behind it can be updated any time — that's a feature, it's why the code doesn't need reprinting when a menu changes. But it's also a real risk: a link that was completely legitimate when the code was printed could, in theory, get pointed somewhere bad later, with no visible sign to anyone looking at the printed code. So every single destination change is logged — old URL, new URL, timestamp — permanently. Not just for suspicious changes. Every change, always, so there's a real record if one is ever needed.

Verification is a badge, not a wall

Businesses can prove they control a destination domain — a DNS record or a page tag does it — and get a verified badge for it. What it deliberately isn't is a requirement to use xxsml at all. Plenty of completely normal links point at a domain the business doesn't own: a delivery partner's ordering page, a review site, an Instagram profile. Blocking those would break the product for the common case to guard against the rare one. Verification is there so a business can prove ownership when it matters, not a gate everyone has to clear first.

If something looks wrong

If you ever run into an xxsml link that seems off, the contact form on our homepage reaches a real person, not a ticket queue that nobody reads. Tell us the link and what looked wrong.

None of this is complicated on purpose. A link is a small thing to trust someone with. We'd rather earn that a link at a time than ask for it up front.

— the xxsml team