Federated safety feed

The hosted instance's scanning protects the whole network. imaginook.com publishes a signed, versioned blocklist feed of the hosts and files it has actioned; small instances opt in to consume it (auto-delisting matches) and optionally contribute their own. It works with any moderation posture — a zero-content-moderation instance can still consume the feed for the illegal-content floor.

Both directions are off by default and toggled from Admin → Safety feed (the persisted setting takes effect without a restart). Consuming is signature-verified and SSRF-guarded; the upstream key is pinned trust-on-first-use.

Feed format

GET /safety/feed.json (served only when Contribute is on) returns:

{
  "payload": {
    "version": 1,
    "type": "safety-feed",
    "instance": { "name": "…", "url": "https://…" },
    "entries": [
      { "type": "host", "host": "bad.example.com", "category": "malware", "actioned_at": "…" },
      { "type": "host", "host": "csam.example.com", "category": "actioned", "actioned_at": "…" },
      { "type": "file_hash", "algorithm": "sha256", "hash": "<64 hex>", "category": "phishing", "actioned_at": "…" }
    ]
  },
  "algorithm": "Ed25519",
  "public_key": "<base64>",
  "signature": "<base64 detached>"
}

The payload is deterministic (no per-request timestamp) so the signed response is edge-cacheable.

Legal review — allowed and disallowed entry types

This is the review output required before any instance contributes. It is enforced in code by SafetyFeedSerializer (publish side) and SafetyFeedConsumer (consume side), and asserted by tests. No configuration can relax it.

Allowed:

• host entries — a hostname this instance has actioned, plus a coarse category and a signed timestamp.
• file_hash entries — malware or phishing files by SHA-256 only.
• An opaque CSAM signal — a CSAM-actioned host appears only as a host entry with category actioned. It carries no filename, no path, and no hash.

Only safety suspensions are published: a host entry's category is reduced to the coarse vocabulary actioned | malware | phishing | abuse — any free-text moderator reason (which could hold reporter/victim PII or an evidence path) becomes opaque actioned. Taste (nsfw) and copyright (dmca) suspensions are never published — they are not safety matters and must not propagate as cross-instance abuse signals.

Disallowed (never published or accepted):

• Raw CSAM or PhotoDNA hashes — these are licensed and non-redistributable. A CSAM/PhotoDNA hash entry, or a photodna/csam_hash entry type, is rejected outright (the publisher throws; the consumer drops it).
• Any file hash for a CSAM category, in any algorithm.
• Free-text categories, personal data, evidence keys, or scanner internals.
• Taste (nsfw) or copyright (dmca) suspensions.

Consuming

Set the upstream URL and enable Consume. imaginook:sync-safety-feed (hourly) pulls <upstream>/safety/feed.json, verifies the signature against the pinned key, mirrors the entries, and delists any local site whose host matches a non-allowlisted entry — enqueuing it in the moderation queue with feed provenance for a moderator to confirm or revert.

Correcting a false positive

• A local allowlist (host or hash) always overrides an incoming entry.
• A moderator revert re-lists the site and adds it to the allowlist, recorded in the audit log.
• The owner of a delisted site can appeal; an upheld appeal is resolved by the same revert (re-list + allowlist), with an audit trail.