In preparation · sign-up not open yet

Security

A link shortener without abuse controls is a risk for everyone

What is already built, what is missing and how to report a link.

Policy

Why it matters

Short links hide the destination, which is why they are used for phishing and malware. That is why Forklink will not open the free plan before these controls are reviewed. This page separates what is already built from what is still missing.

Already built in the link product

Not yet deployed for Forklink; it is verified in the code and its tests.

1

Public abuse report

Anyone can report a link without an account. Limits: 5 reports per IP per hour, 300 per hour overall, 16 KB maximum body, a honeypot field against bots; the IP is stored as a keyed hash (HMAC).

2

Automatic hold

Phishing or malware reports from several distinct people hold the link for review (an “under review” page); the owner can appeal.

3

Link and account suspension

Moderation can suspend a link (it answers 410) or a whole account; a suspended link cannot be reactivated by its owner.

4

Limited new accounts

Optional: a cap on links per hour and in total, and no custom domains or API keys until the account is verified.

5

Warning page

If a destination is flagged as unsafe, a warning is shown with no continue button and the click is not counted.

Still missing

What is missing before the free plan opens

  • An active Google Safe Browsing key and a second source (today the check is skipped without a key).
  • A human check (Turnstile) on account sign-up and not only on workspace creation.
  • An application firewall and rate limits at the edge, and 2FA for team accounts.
  • A published response time for reports.
  • An independent security review.

Until that list is done, the free plan and sign-up stay closed.

Did you see a link that looks like fraud?

Report it with the abuse form. Include the full short URL and the reason. We do not share other people's data in replies.

Report a link

Timelines

What to expect from a report

We explain what happens after a report and why there is no committed response time today on the report page.