Trust & safety

Report abuse

Last updated: 2026-09-14

flypod lets anyone publish a page without an account. Some of those people will be phishing, and pretending otherwise would be worthless to you. This page says exactly what is screened and when, what happens when you report a site, and where the gaps are.

Report a site

Anything hosted on a flypod.page subdomain can be reported here — that is where every flypod site is served, whether or not it belongs to an account. Give the URL and what you saw. A report goes straight into the operator's queue.

flypod does not serve user content on flypod.dev. That domain is the site you are reading, the docs, the API, and account pages. If a page on flypod.dev itself looks like a phishing page, it is not a flypod site — report it anyway, at the address below, and say so. Site URLs handed out before 14 September 2026 used <site-id>.flypod.dev and redirect to flypod.page until 13 December 2026; reporting either form works, and the site ID is the same in both.

Prefer email, or need to reach a human — a registrar, host, or security team? Write to abuse@flypod.dev. Reports are read and actioned by a person, and a site can be taken offline immediately without waiting for the deployer.

Reporting without the form

The form posts to the public abuse endpoint. You can call it directly — it takes a JSON body with site_id and reason, plus an optional reporter, and answers 202 when the report is filed:

curl -X POST https://flypod.dev/abuse \
  -H 'content-type: application/json' \
  -d '{"site_id":"a3f1c2d4e5b60789","reason":"phishing","reporter":"you@example.com"}'

Reports are rate-limited per IP address, and a report for a site ID that does not exist is rejected with 404.

What happens to a report

Reports are read by a person — flypod is run by an individual, not a trust-and-safety department. Confirmed phishing, malware, and impersonation get the site disabled; that is a single operation and it takes effect immediately for every visitor. Ambiguous reports take longer, because judging them badly in either direction is worse than judging them slowly.

The intent is to look at every report the day it arrives, and to act on clear-cut phishing as soon as it is seen. That is a commitment to effort, not a contractual response time: flypod is a free service with no service-level agreement, and publishing an SLA that cannot be honoured would be worth less to you than the truth.

What flypod screens, and when

Every version passes through a content scan before it is stored — the first deploy and every update after it. Screening only the first upload would be theatre: the oldest trick in phishing is to deploy something harmless, collect the URL, and then replace the contents.

The scan starts from one fact about a static host. flypod runs no server code, so a password typed into a page here cannot be stored here — it has to leave, to some absolute off-site address. That makes the distinction we care about a narrow and checkable one:

A credential surface wired to an off-site collector is rejected outright with a 403. A page that asks for a password and is built to ship it somewhere else is a working kit, whatever it looks like.
A credential surface with no collector — a sign-in mockup, a design demo, a tutorial — is not rejected. It deploys normally and gets 24 hours instead of 14 days. If it is what it looks like, that is plenty; if it was a kit waiting for its payload, it expires before it is useful.
Outbound link reputation. When the server is configured with a Google Safe Browsing API key, the http(s) links in an upload's HTML are checked for malware, social engineering, and unwanted software, and a match blocks the deploy.

We are not going to publish the full list of signals, because that is a bypass guide. What we will say is the limit: a careful attacker gets through. Nothing about a static file is inherently detectable as fraud, and a scanner aggressive enough to try would break legitimate sign-in demos, security research, and a large amount of ordinary web content. That is why the middle tier shortens a life rather than refusing a deploy — it makes a wrong guess cheap for you instead of expensive. Screening is a filter, not a guarantee. Reports and takedowns are what handle the rest.

Zero-auth is not no-auth is the longer version of this: why there is no account wall, what that does and does not mean, and what is still unfinished.

Takedowns

The operator can disable any site immediately, without notice and without deleting anything first. A disabled site stops serving to every visitor at once; requests to it get HTTP 451 instead of the content. Disabling is reversible, so a mistaken takedown can be undone rather than turning into permanent data loss.

Under the terms of service, content may be removed, disabled, or refused at any time, for any reason. Repeat abuse can also get an IP address or domain blocked.

Deploys expire, which limits the damage

Anonymous deploys are deleted 14 days after they are created — files and site record both. Abandoned abusive content therefore has a maximum lifetime whether or not anyone ever reports it, and a phishing page that outlives its campaign cannot sit on the internet indefinitely. Deploys made from an account do not expire, but they are attached to a real identity.

Deploys, claims, and abuse reports are all rate-limited per IP address, which bounds how fast a single source can flood the service.

What this does not solve

A free host that asks nothing of you is a free host for everybody, including people acting in bad faith. Screening is narrow by design. Expiry limits lifetime but not the first 14 days. Takedowns are reactive and depend on someone noticing. This is an ongoing problem, actively worked, and not a solved one — anyone who tells you their open publishing platform has solved it is selling something.

Serving every site on flypod.page is part of the same accounting. It does not stop a bad upload, but it decides what a bad upload can cost: a domain reputation hit lands on the domain that carries anonymous uploads, and not on the one carrying the API, the docs, and account email.

What is on offer is the honest version: a narrow automatic filter, a reporting path with no account required, an immediate off switch, content that deletes itself by default, and a domain split that keeps the blast radius where it belongs.