The top 20 domains are interesting in that they use hundreds of unique payment links (buy.stripe.com) - it really shows the value in Stripe's investment in No-Code features.
Could be nice to add a message on desktop saying the site only works on mobile! I was confused at first asking for feedback when there was nothing to click on the desktop site.
Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url).
A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.
> This app has access to: Device & app history Allows the app to view one or more of: information about activity on the device, which apps are running, browsing history and bookmarks