Moderation policy

Imaginook separates two things that are often conflated:

• The illegal-content floor — CSAM / malware / phishing scanning and the federated safety feed. This is always on and is independent of any setting an operator chooses. Nothing in the moderation policy can disable it.
• Content-taste policy — how strict the instance is about legal content: profanity, NSFW, directory-listing requirements, and automatic actions. This is the tunable layer described here.

The hosted imaginook.com runs a permissive-but-legal baseline (a posture similar to X.com). A self-hosted instance can be stricter (zero profanity, manual approval) or looser (no taste moderation at all) — without ever lowering the illegal floor.

Presets

There is a single active policy for the instance (moderation_policies, one row). Selecting a preset stamps its values onto that row; Custom persists per-field overrides. Preset changes are admin-only and audited.

Field	Baseline	Strict	Minimal
Profanity	allow	block	allow
NSFW	filter	block	allow
Auto-action	on (≥ 8 flags)	on (≥ 3 flags)	off
Directory: require clean scan	yes	yes	yes
Directory: min site age	24 h	72 h	0 h
Directory: require approval	no	yes	no

The preset field values live in config('imaginook.moderation.presets').

Enforcement

• Profanity (ContentPolicy) screens user-submitted text (e.g. guestbook signatures): allow passes through, filter masks matched terms, block rejects the submission. Matching folds leetspeak and compares whole tokens (so "grapes" is never flagged for containing "rape"), and collapses spaced-out runs ("f u c k"). It is a best-effort taste filter over a small starter blocklist — determined evasion (unicode homoglyphs, partial spacing) can still slip through, which is acceptable because the illegal floor is independent.
• NSFW applies to moderator-raised nsfw flags (there is no automatic NSFW detector): allow does nothing, filter delists the site from the directory (reversible), block takes it offline.
• Directory requirements gate a site out of the public directory until the enabled requirements are met. The quarantine gate below these is the illegal floor — a site holding a quarantined (malware/CSAM) upload is never listed, regardless of the clean-scan toggle. Note the difference between the two adverse scan states: quarantined (illegal content detected) is always floored, while a failed (unscannable / scan errored) upload is only excluded when directory_require_clean_scan is on — which every shipped preset keeps on. Turning it off is an explicit operator choice to list unscannable sites; it can never surface a quarantined one.
• Auto-action thresholds take a site offline once its count of unresolved moderation flags reaches auto_suspend_threshold (0 disables). Only trusted (automated scan / safety-feed) or staff-triaged (manual, claimed, escalated) flags count — a raw anonymous public report never counts until a moderator has claimed or escalated it, so a distributed report flood cannot take a site offline on volume alone.

The floor is not configurable

Automated scan verdicts for illegal content (source = scan, category csam/malware/phishing) auto-suspend a site regardless of the active policy — even under Minimal or a fully permissive Custom policy. The regression suite asserts this floor cannot be disabled by any configuration.

The full configuration UI arrives with the v0.12 config manager; today the engine is operable from Admin → Policy.