Custom link text can be used for phishing

[dbkr]

Possibly even conditionally whenever link text is, "this", "here", "click here" etc

[lampholder]

So an option in settings that, when checked, auto-replaces any link posted with link text 'this', 'here', or 'click here' or similar and replaces it with the much-more-enlightening actual URL.

[Twi1ightSparkle]

Including for example

/html

<a href="https://google.com">https://bing.com</a>

markdown

[https://bing.com](https://google.com)

Another solution is something similar to what Discord is doing. When you click a link they ask you if you trust the domain and you can allow once or always allow.