Snipr — פלטפורמת ניהול קישורים

A link shortener looks trivial until you run one in production: redirects have to stay sub-30ms under load, analytics cannot block the hot path, malicious destinations need scoring and interstitials, and abuse handling, rate limiting, API keys, webhooks, RBAC and audit trails all have to exist before anyone trusts you with their traffic. Most open shorteners stop at "create code → redirect" and leave operability, safety and multi-tenant concerns as an exercise. The goal was a single-node foundation that already carries the full production surface - security, observability, a real API and URL safety - finished to a standard you could sell, white-label or self-host.

Built on Express (Node 22, ESM) with SQLite (WAL) locally or PostgreSQL for durable deploys, a layered redirect cache (in-memory + optional Redis), and a React 19 / Vite / Tailwind dashboard. The full feature set: cached `/:code` redirects plus `/p/:code` OG-preview pages; buffered, batched analytics with human-vs-bot breakdowns and preview-bot intercept (Slackbot, iMessage, SafeLinks) so previews never fire fake clicks; device + UTM routing (iOS / Android / desktop targets, UTM builder); password-protected links, expirations, custom branded domains, campaigns and tags; URL safety scoring at create time with an interstitial warning page (optional Google Safe Browsing); public abuse reporting with an admin moderation queue and auto-flag thresholds; per-user scoped API keys (links / analytics / webhooks scopes) documented in an OpenAPI spec; signed `link.click` webhooks with an admin dead-letter queue and replay; roles & capabilities (user / admin) with a per-user audit log; feature flags with env overrides; QR codes; account deletion and full data export (SAR). Production-hardened throughout: HSTS, security headers, login-attempt lockout, password complexity, CSRF double-submit, Redis-backed distributed rate limiting, Postgres advisory-locked migrations, optional Sentry, health/readiness probes (`/healthz`, `/readyz`) and a token-protected Prometheus `/metrics` endpoint. CI runs `npm audit` and the test suite against both SQLite and PostgreSQL.