Cyber & Digital Crime · Cybersecurity commentary

Your Security Bookmark Folder Is a Supply Chain

We scan package manifests for poisoned code, then click four-year-old security links as if ownership, DNS and page content never change.

By Richard Vincent · August 24, 2026

AI-assisted research and drafting; reviewed and approved by Richard Vincent.

Cybersecurity has a dependency problem hiding in plain sight.

We have lockfiles for software libraries. We generate SBOMs. We pin container images, verify signatures and argue about whether a four-day-old package has enough maintainer history to enter production.

Then we open a giant list of "trusted security tools" and click whatever is blue.

That list is a supply chain too.

On August 24, 2026, GSJ reviewed a sprawling, community-curated map of the open web: 3,086 lines, 78 headings and 1,454 link entries covering usernames, email addresses, infrastructure, maps, public records, breach research and social platforms. Its public revision history stopped in July 2022. The labels stayed still. The web did not.

The directory contained 1,445 unique URLs. Our point-in-time check found that 1,098 returned HTTP 200. Fifty-two returned a definitive 404 or 410. Another 179 hit connection, DNS, TLS, redirect or timeout errors. One hundred and one were written with plaintext HTTP.

Those numbers already describe an aging resource. They do not describe the most interesting part.

The links that mattered most were not always broken. Some worked perfectly.

In our August 24, 2026 manual review, a listing for disposable SMS verification forwarded to a domain advertising gambling. A Bitcoin privacy guide led to a casino page, and a social analytics tool landed at an unrelated retailer. Other links reached parked domains or pages for sale.

That does not prove the people who assembled the collection did anything malicious. It proves something more ordinary and more useful: an old recommendation can keep circulating after the thing behind it has changed.

"200 OK" is not a security verdict

A normal link checker asks whether a server answered. That is useful for maintenance. It is weak evidence of trust.

A successful response cannot tell you whether the domain changed owners, whether the service changed purpose, whether a redirect crossed into a different registered domain, or whether the page still does what the old description claims. It certainly cannot tell you whether an investigator should paste a phone number, email address, username or case detail into the page.

That is the part security teams routinely miss. Clicking a link is not passive. Your browser resolves a domain, connects to infrastructure, negotiates TLS, processes redirects and loads code and content chosen by whoever controls the destination today. If you submit a target identifier, you have made a disclosure decision too.

My hot take is simple: a hyperlink is an untracked dependency with a user attached.

The broader web is already telling us this maintenance model does not hold. Pew Research Center reported in 2024 that one-quarter of the pages it collected from 2013 through 2023 were inaccessible by October 2023. Among pages from its 2013 snapshot, 38% were inaccessible.

Researchers presenting at the 2024 ACM Web Conference found a sharper version of the problem. Their large-scale crawl identified active links to more than 572,000 dot-com domains that had never been registered. They registered 51 of those "phantom domains." Eighty-eight percent received more traffic than a control domain, and some received up to ten times as many visits.

An erroneous link can manufacture trust before anyone owns the destination.

Expired and abandoned domains can create even uglier outcomes. In a separate piece of original research, watchTowr Labs reported buying a $20 domain that had been embedded in backdoors. More than 4,000 live backdoors later checked in to infrastructure the researchers controlled. That is not the same vector as an old bookmark list, and it should not be presented as one. The shared lesson is that old references keep making decisions long after their original owners stop watching.

CISA's own linking policy says the agency reviews internal and external links quarterly. That sounds almost comically mundane next to threat intelligence, zero days and nation-state campaigns.

It is also the right instinct.

Security needs a lockfile for trust

No one needs to invent a blockchain for bookmarks. The control is boring.

Every operational link collection should record the original URL, registered domain, expected owner, effective destination and date last verified. A redirect into a different registered domain should enter a review queue. A major title or content change should do the same. Links that accept sensitive search terms should carry a higher risk label than a public-record page that only serves documents.

Investigators should open unreviewed services in an isolated browser and keep target data out until ownership and purpose are clear. If a page matters as evidence, archive the source and record when it was retrieved instead of assuming the live URL will preserve the same claim forever.

None of this makes a 1,400-link directory easy to maintain. That is exactly the point. A collection too large to verify is too large to describe as trusted.

Security people understand this when the dependency is code. An abandoned package can change hands. A compromised maintainer can ship something new. A version number without provenance is not enough.

A URL deserves the same suspicion. The domain can expire. The redirect can change. The service can be sold. The page can answer "200 OK" while becoming something else entirely.

We do not have a shortage of security tools. We have a surplus of inherited trust.

Before you add another bookmark to the workbench, ask the question we already ask about software: Who controls this dependency now?