https://launchkit.codes/yield/rails-url-shortener

One model, one controller, one route. The slug generates itself through the attribute API and SecureRandom.alphanumeric, so a record is valid before it has ever been saved, which a database default cannot do. The click counter goes through increment_counter, which deliberately leaves updated_at alone. And allow_other_host: true is both the line that makes the redirect work and the line that turns the whole thing into an open redirect the moment the target comes from params instead of from a row you control. Write-up plus a 9-minute video.