url-shortener

The logout link doesn't check for a nonce, see:

https://github.com/YOURLS/YOURLS/blob/42fd3b85c2d49120f3328c7f77ce4d5c100fcc61/admin/admin-ajax.php#L43-L46

A mean hax0r can trick a naive user into logging out themselves if they're redirected to http://their-your.ls/admin/index.php?action=logout.

Definitely not a big deal, but also trivial to fix.

Without all the marketing.

In UrlShortener.cs around line 109 the cleaning should be inside the object ShortUrlEntity

            string longUrl = input.Url.Trim();
            string vanity = string.IsNullOrWhiteSpace(input.Vanity) ? "" : input.Vanity.Trim();
            string title = string.IsNullOrWhiteSpace(input.Title) ? "" : input.Title.Trim();

Please refer to the doc:

https://chakra-ui.com/docs/features/color-mode