Security & Embed Integrity
Last updated: July 19, 2026
Publishers embed BetterLink on their own websites, so we hold the integration to a higher bar than a normal web app. This page explains the protections around site tokens, the hosted script, and your visitors' clicks.
1. Site Tokens Are Bound to Your Domains
Each site integration has a generated token and server-side domain allowlist. The token appears in publisher page HTML and should be treated as an integration identifier rather than an account password.
BetterLink validates site context before applying publisher settings, localization, or click tracking. Requests that fail validation may be rejected or sent to a safe direct destination. Publishers can rotate integration tokens from the dashboard.
Smart Router v2 can include the current source page when a link is clicked so BetterLink can report where a placement pointing to a currently Unavailable product needs repair. Before storage, BetterLink verifies the integration owner and allowed hostname and removes credentials, query strings, and fragments. Source locations are aggregated only while that Amazon Product Health observation is current and are not tied to a visitor identity.
2. Script Integrity and Version Pinning
BetterLink serves its hosted embed scripts over HTTPS from version-controlled releases. Publishers can use the updating script URL or choose a version-pinned integration.
Publishers who want additional integrity controls can use a version-pinned snippet with Subresource Integrity. A pinned file (for example /smart-router-v2.js) can be paired with an integrity hash so the browser checks the fetched file against the expected content. Publishers control upgrades by changing the pinned snippet and may also self-host a pinned copy and configure its data-api attribute.
3. Redirect Safety
The Smart Router preserve-mode proxy accepts supported Amazon destinations and rejects non-Amazon destination parameters. A separately created managed BetterLink may point to a stored Amazon URL or another validated HTTP(S) destination. Because the destination is stored by the account owner rather than supplied as an unrestricted redirect parameter at click time, managed links are not general-purpose open redirects. Invalid, unknown, blocked, or unavailable requests may fall back, return an error, or return a not-found response.
4. Rate Limiting and Monitoring
BetterLink applies rate limits, origin and ownership checks, input validation, logging, and operational alerts to relevant integration and account endpoints. These controls are designed to reduce abuse and aid investigation, but no security control or monitoring system eliminates all risk.
5. Reporting a Vulnerability
If you believe you've found a security issue, please reach out via our contact page so we can review it. A machine-readable pointer is published at /.well-known/security.txt.