fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286) #404

Merged

jared merged 1 commits from fix/preview-deceptive-links into lotus

2026-10-18 06:15:47 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	7b3d1bad8f	fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286 ) CI / Build & Quality Checks (pull_request) Successful in 3m6s Details CI / Trigger Desktop Build (pull_request) Skipped Details CI / Docker image build & smoke test (pull_request) Skipped Details CI / Secret scan (gitleaks) (pull_request) Successful in 9s Details CI / Playwright smoke (e2e) (pull_request) Successful in 21m16s Details Previews are built from the plain body, clicks follow formatted_body's hrefs, and a sender controls both: text "https://paypal.com" linked to evil.example showed a real PayPal card. Drop body URLs whose site is only claimed by the visible text of a mismatched link (linkSafety). Fixes #286 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:05:06 -04:00