Problem
isBotScan() in server/utils/scan-notify.ts only checks cf.botManagement.verifiedBot plus four UA markers (bot, crawler, spider, preview). Several social link-preview fetchers match none of these — facebookexternalhit, whatsapp, tiktok, mastodon, snapchat — so pasting a short link into WhatsApp/iMessage/Facebook can fire a false "someone scanned your link" push when nobody actually visited.
Rare for the QR-on-physical-object use case, but a real annoyance for digitally shared links.
Why it matters
False pushes erode trust in the notification feature — the whole point is "the physical world touched your link."
Suggested fix
server/middleware/1.redirect.ts already maintains a richer SOCIAL_BOTS list for OG-preview rendering. Export/share that list (e.g. move to a server util) and check it in isBotScan() alongside the existing markers.
Flagged by the final whole-branch review of the scan-notifications feature (shipped in 615f972..e59b76c).
Problem
isBotScan()inserver/utils/scan-notify.tsonly checkscf.botManagement.verifiedBotplus four UA markers (bot,crawler,spider,preview). Several social link-preview fetchers match none of these —facebookexternalhit,whatsapp,tiktok,mastodon,snapchat— so pasting a short link into WhatsApp/iMessage/Facebook can fire a false "someone scanned your link" push when nobody actually visited.Rare for the QR-on-physical-object use case, but a real annoyance for digitally shared links.
Why it matters
False pushes erode trust in the notification feature — the whole point is "the physical world touched your link."
Suggested fix
server/middleware/1.redirect.tsalready maintains a richerSOCIAL_BOTSlist for OG-preview rendering. Export/share that list (e.g. move to a server util) and check it inisBotScan()alongside the existing markers.Flagged by the final whole-branch review of the scan-notifications feature (shipped in 615f972..e59b76c).