Blog

Notes on link verification, corporate trust, and honest cryptography — from the team building Linktary.

• Anatomy of a malicious redirect chain

  2026-09-25 · 8 min read

  A hostile chain walked hop by hop — a lookalike domain, an HTTPS downgrade, an executable payload — with the trust report scoring it to BLOCKED. Illustrated with the engine's own test fixtures.

• Enterprise buyer's guide: evaluating Linktary (the security questionnaire, pre-answered)

  2026-09-25 · 10 min read

  Data flow, retention windows, subprocessors, incident response, and DPA posture — the standard vendor security questionnaire, answered against the actual architecture before you ask.

• How Linktary verifies a link

  2026-09-25 · 9 min read

  The verification engine, step by step: the bounded chain fetch, the signal taxonomy, the score thresholds behind every SAFE, CAUTION, and BLOCKED verdict — and why the whole thing runs at creation, never on the click path.

• The honest crypto design: what we can't see, and why we say so

  2026-09-25 · 11 min read

  Zero-knowledge of a URL and server-side verification of that same URL cannot both be true. So we split the data: what Linktary encrypts, what it must see, what it never stores — and the one attack we don't protect against.

• Why your corporate network blocks URL shorteners (and what allowlist-grade means)

  2026-09-25 · 7 min read

  A short link is an opaque redirect — and opaque redirects are how phishing, malware, and data-loss bypasses get through. Written for the IT admin who owns the blocklist.