The preview collision

Messaging, email, and security products visit links to create previews, scan malware, or evaluate reputation. These requests may execute JavaScript, follow redirects, use realistic browser headers, and originate from changing networks. Treating “first GET” as “first human read” is therefore unreliable.

Separate landing from consumption

The initial GET should return a neutral landing page without consuming the ciphertext. A deliberate user action can then issue a state-changing request, ideally using POST with a fresh anti-forgery token. The response should carry no-store cache directives and must not expose secret content in preview metadata.

The consume operation must be atomic. Reading and deleting in separate database steps can allow concurrent requests to retrieve the same note. A transaction or single conditional operation should move the record from available to consumed exactly once.

Do not rely on bot guessing

User-agent lists are incomplete and easily spoofed. JavaScript challenges and timing signals may reduce accidental previews but can exclude assistive technology or privacy-focused users. The primary control should be explicit confirmation, with bot classification used only as supporting evidence.

Label the action clearly: “Open and destroy this note.” Users should understand that refreshing or navigating away may not recover the content.

Test real delivery paths

Before release, share instrumented non-secret links through every supported channel: Slack, Teams, Discord, email security gateways, mobile notifications, and ticketing tools. Record request sequences without logging fragments or sensitive query strings. Test simultaneous clicks, retries, expired notes, blocked JavaScript, and accessibility keyboard flows.

Bot protection succeeds when automation can inspect a harmless landing page while only an intentional, understandable user action consumes the protected object.

Sources and review basis

This guide is maintained as defensive-security education. The editorial team reviews its recommendations against current implementation experience and these authoritative references: