Levels
| Level | Score | Suggested handling |
|---|---|---|
| safe | 80–100 | No suspicious signals found; proceed with normal care |
| caution | 40–79 | Show the full destination and ask the user to confirm |
| danger | 0–39 | Block automatic navigation and require an explicit override |
safe
- Score
- 80–100
- Suggested handling
- No suspicious signals found; proceed with normal care
caution
- Score
- 40–79
- Suggested handling
- Show the full destination and ask the user to confirm
danger
- Score
- 0–39
- Suggested handling
- Block automatic navigation and require an explicit override
Signals
| Signal | What it means |
|---|---|
| redirect_chain | The link passes through one or more redirects before its destination |
| lookalike_domain | The host closely resembles a well-known brand or bank domain |
| insecure_scheme | The destination uses http:// or a non-standard port |
| new_domain | The domain was registered very recently |
| credential_form | The landing page asks for a password or payment details |
redirect_chain
- What it means
- The link passes through one or more redirects before its destination
lookalike_domain
- What it means
- The host closely resembles a well-known brand or bank domain
insecure_scheme
- What it means
- The destination uses http:// or a non-standard port
new_domain
- What it means
- The domain was registered very recently
credential_form
- What it means
- The landing page asks for a password or payment details
Limitations
The score is a heuristic aid, not a verdict. A safe level means no known signals matched - it is not a promise that a destination is trustworthy, and a danger level can occasionally flag a legitimate link.
Treat the safety layer as one input in your own review flow, and keep a human confirmation step for anything involving money or credentials.