...Are you sure this is non-custodial? ...
I'm presuming as much from the fact the URL alone is (was) enough to redeem the funds. (no passwords or other auth required).
The fact that it's an URL instead of a code makes me think it needs the server to release funds. In other words: in that case it's custodial.
But if each "URL" has it's own address, that might not be the case.
Hence, why I was hoping someone smarter than me might take a peek at the code
Sorry, I can't do that
