All Works
Founder and engineer/Apr – Jul 2026

Linkord

A link-in-bio product, hardened like a real SaaS

A customisable link-in-bio page for creators. The interesting part is everything around the pages: payments, a media pipeline on self-hosted storage, abuse protection, and a tester programme that actually found bugs.

Live · linkord.lol For: Creators and Discord communities
262
commits in four months
~23k
lines removed in a rebuild for simplicity
111
items in the external test checklist
Linkord's home page

// The Problem

Link-in-bio tools are a crowded, cosmetic market. The question was what it takes to run one properly: take money safely, store and serve user media cheaply, and keep abuse out.

// How It's Built

  1. Dashboard

    Edits save through one server action

  2. Server action

    Claims the handle, filters profanity, gates paid fields, busts the cache

    • Firestore

      Profiles and accounts

    • MinIO on my server

      Images and video, optimised on upload

  3. Public page

    Incremental static regeneration, tagged per handle

Public pages are cached per handle and refreshed the moment their owner publishes.

// Decisions & Trade-offs

  • 01

    Payments without the SDK

    Razorpay orders, signature checks and webhooks go over the REST API with HMAC verification, plus a restore path that reconciles a paid order if the browser never came back.

  • 02

    Own the media storage

    Uploads moved from a hosted bucket to S3-compatible storage on my own server, with server-side optimisation: WebP with size caps, animated GIFs turned into silent looping video, videos paused when off-screen.

  • 03

    Delete to simplify

    A rebuild removed about 23,000 lines (a visual editor, dozens of effects and fonts) to make the product simple to use, then features came back one at a time.

// Problems Worth Telling

  • 01

    An importer that could be pointed inward

    The profile importer fetches a URL the user gives it, which is a server-side request forgery risk. It was guarded, then a redirect-based bypass was found and closed.

  • 02

    A test round that passed everything

    The first external test round came back 111 of 111 ticked while the tester's notes described real breakage, because ticking was the only way forward. Every item is now answered worked, problem or didn't try.

// Quality

  • Durable rate limiting, a profanity filter on handles, an ops watchdog that alerts before customers notice an outage.

// Where It Stands

  • Live at linkord.lol.

// Stack

Next.js 16React 19TypeScriptClerkFirestoreMinIO (S3-compatible)RazorpayTailwind v4
Next case studyViato

Building something similar?

Let's talk