miantiao-me
diff --git a/‎docs/faqs.md‎
Lines changed: 5 additions & 2 deletions b/‎docs/faqs.md‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎server/utils/template.ts‎
Lines changed: 12 additions & 1 deletion b/‎server/utils/template.ts‎
Lines changed: 12 additions & 1 deletion
diff --git a/‎tests/redirect.spec.ts‎
Lines changed: 3 additions & 0 deletions b/‎tests/redirect.spec.ts‎
Lines changed: 3 additions & 0 deletions
@@ -53,7 +53,9 @@ Set `NUXT_DISABLE_BOT_ACCESS_LOG` to `true`.
 
 ## 9. What is Link Cloaking?
 
-Link cloaking masks your destination URL by showing your short link domain in the browser address bar instead of redirecting to the target URL. The destination page loads inside a full-screen iframe.
+Link cloaking keeps your short link in the browser address bar instead of redirecting the top-level page to the target URL. The destination page loads inside a full-screen iframe.
+
+It is a simple iframe-based feature. It does not hide the destination URL from page source, browser developer tools, network logs, or users who inspect the page.
 
 ### How to enable it
 
@@ -63,7 +65,8 @@ Toggle **Enable Link Cloaking** in the **Link Settings** section when creating o
 
 - **Sites that block iframes**: Websites with `X-Frame-Options: DENY` or `Content-Security-Policy: frame-ancestors 'none'` will not load inside the iframe. Most major sites (Google, GitHub, Twitter, etc.) block iframe embedding.
 - **HTTPS required**: The destination URL must use HTTPS. Mixed content (HTTPS short link → HTTP destination) will be blocked by browsers.
-- **Limited interaction**: Some features like OAuth login flows, `window.top` navigation, and certain payment forms may not work correctly inside the iframe.
+- **Limited interaction**: Some features like OAuth login flows and certain payment forms may not work correctly inside the iframe. Sink allows user-activated top-level navigation to improve checkout and external redirect compatibility, but it cannot make every embedded site work.
+- **No target URL hiding**: Sink does not proxy cloaked links or rewrite destination pages. This keeps cloaking simple and predictable, but the target URL can still be inspected by visitors.
 - **Device redirects take priority**: If both cloaking and device redirects (iOS/Android) are configured, device redirects will take precedence on matching devices.
 
 ### If the destination site blocks iframes
 
@@ -2,6 +2,17 @@ import type { Link } from '#shared/schemas/link'
 import { escape } from 'es-toolkit/string'
 import { parseURL } from 'ufo'
 
+const CLOAKING_IFRAME_SANDBOX = [
+  'allow-scripts',
+  'allow-same-origin',
+  'allow-forms',
+  'allow-popups',
+  'allow-popups-to-escape-sandbox',
+  'allow-top-navigation-by-user-activation',
+  'allow-downloads',
+  'allow-modals',
+].join(' ')
+
 function buildMetaTags(link: Link, baseUrl: string) {
   const { host: hostname } = parseURL(link.url)
   const title = link.title || hostname || 'Link'
@@ -39,7 +50,7 @@ export function generateCloakingHtml(link: Link, targetUrl: string, baseUrl: str
     ${tags}
 </head>
 <body style="margin:0;overflow:hidden">
-    <iframe src="${escape(targetUrl)}" style="width:100vw;height:100vh;border:none" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox" allowfullscreen referrerpolicy="no-referrer"></iframe>
+    <iframe src="${escape(targetUrl)}" style="width:100%;height:100%;width:100vw;height:100vh;border:none" sandbox="${CLOAKING_IFRAME_SANDBOX}" allowfullscreen referrerpolicy="no-referrer"></iframe>
     <noscript><meta http-equiv="refresh" content="0;url=${escape(targetUrl)}"></noscript>
 </body>
 </html>`
 
@@ -117,6 +117,9 @@ describe('/', () => {
     expect(response.status).toBe(200)
     expect(html).toContain('<meta name="viewport" content="width=device-width,initial-scale=1">')
     expect(html).toContain(`<iframe src="${targetUrl}"`)
+    expect(html).toContain('allow-top-navigation-by-user-activation')
+    expect(html).toContain('allow-downloads')
+    expect(html).toContain('allow-modals')
   })
 
   it('prefers device redirect over geo redirect', async () => {