OPEN PRODUCT SPECIFICATION · V1

Community evidence may request review. It may never decide alone.

The threat feed is deliberately advisory and privacy-thresholded to resist merchant-targeting and data leakage.

Eligible observations

Only production observations tied to cryptographically attributable signature or purchase-binding failures are eligible. Ordinary budget, allowlist, replay or heuristic prompt findings are excluded.

Privacy and namespace

Merchant identifiers are normalized with the source protocol, transformed with a keyed HMAC and never published. A signal appears only after three independent accounts contribute within a rolling 90-day window.

Decision effect

A qualifying signal can move an otherwise clear result to REVIEW. It can never create an automatic BLOCK and cannot override stronger local evidence.