Security Architecture & Report
Comprehensive technical breakdown of ShortKing's production security controls, defense-in-depth architecture, and vulnerability disclosure policy.
1. Core Security Architecture Overview
ShortKing is engineered with a strict defense-in-depth posture designed specifically for high-throughput URL shortening and traffic routing. Because URL shorteners are historically targeted by malicious actors for phishing cloaking and SSRF exploitation, our platform enforces multi-layer automated gatekeeping on every inbound request.
2. Implemented Production Controls
Inbound URLs are strictly validated using RFC 1918 private subnet detectors, loopback checks, alternative IP encoding decoders (hex, dword, octal), and cloud metadata blocks (169.254.169.254).
Sliding-window Redis and in-memory rate limiters enforce tiered request budgets on URL creation, redirect lookups, management APIs, and admin authentication, returning standard X-RateLimit-* headers.
All user payloads undergo runtime Zod schema parsing. Search queries enforce strict PostgREST filter sanitization to prevent filter injection. Client-side link rendering enforces safe protocol filters (safeHref) to thwart DOM-based XSS attacks.
Automated scanners (sqlmap, dirbuster), headless browser user agents, and rapid payload probers are assigned threat scores and mitigated automatically with structured security audit logs.
3. HTTP Security Headers & Content Security Policy
Every response served by the ShortKing API includes production-grade security headers:
4. Access Control & IDOR Prevention
Link management endpoints strictly verify that either the authenticated user owns the resource, or the caller presents the matching X-Manage-Token. Mismatched credentials return HTTP 404 (instead of 403) to prevent attacker enumeration and IDOR probing.
5. Responsible Vulnerability Disclosure Program
We welcome contributions from security researchers and ethical hackers. If you believe you have found a security vulnerability in ShortKing:
- Include a detailed proof-of-concept (PoC) with step-by-step reproduction instructions.
- Do not disrupt production availability, execute denial-of-service, or alter other users' data.
- Give our engineering team reasonable time (90 days) to mitigate the issue prior to public disclosure.