Click Redirect

The click redirect: record, then send them where they were going.

⛔THE DESTINATION COMES FROM THE DATABASE, NEVER THE REQUEST. There is no ?url= parameter and there must never be one -- that is an open redirect, and an open redirect on the domain we are asking sheriffs' offices to trust is a phishing kit with our name on it. Only URLs we ourselves put in an email are reachable, and the schema refuses anything that is not absolute https.

An unknown token sends them to the public site rather than an error page. A person who clicked a link in a real email should never land on a stack trace because a row was cleaned up -- and, as with the pixel, the failure must not be distinguishable from a success.