nfc-linktree-menu-builder-review

Verify the NFC target URL uses HTTPS, the redirect chain stays at two hops or fewer, and short-link tokens are opaque random strings rather than sequential database IDs. Also confirm expired or disabled cards show a graceful fallback page instead of a 404.

Use error correction level M (15% recovery) as a minimum, and level H (30%) for cards likely to be scratched or printed small. Printed QR codes should be at least 2 x 2 cm with a quiet zone of four module widths on all sides.

Validate all link entries server-side to allow only http:// and https:// schemes, rejecting javascript: and data: payloads. Custom slugs should be restricted to alphanumeric characters plus hyphens with reserved words like admin and api blocked.

iOS Contacts silently fails to import vCards where the embedded photo exceeds roughly 100 to 200 KB. Ensure the .vcf file uses vCard 3.0 or 4.0 format, escapes values per RFC 6350, and serves with Content-Type text/vcard.

Skip it for general marketing landing pages with no NFC, QR, or short-link component, and for backend API reviews with no mobile UX surface. Print-side artwork checks like CMYK and bleed are handled by the merged print-design reference instead.

Load the print-design-artifact-review reference and verify CMYK color mode, 300 DPI effective resolution, 3 mm bleed beyond trim, fully embedded fonts, and PDF/X-1a or PDF/X-4 export. Keep metallic inks and embossing at least 3 mm clear of the NFC antenna zone.