Reports and moderation

Report an artifact

1. Open the artifact's public page and press Report (sign in first).
2. Choose a reason: Prompt injection, Hidden instructions, Credential harvesting, Malicious code or malware, License violation, or Spam or low quality.
3. Add any context or evidence, and press Submit report.

You can have one open report per artifact.

What happens next

• One report does not hide a public artifact. It is hidden from search once several established accounts have reported it, or as soon as Deftro staff report it. New accounts and the artifact's own author do not count. Anyone with the link can still open it, and its page shows a notice.
• Reports on public artifacts, and on any personal account's artifacts, go to Deftro staff. They can dismiss the report, take the artifact down, or restore it. A taken-down artifact is visible only to its owner and their organisation.
• Once those reports are in, installs also pause until staff decide. See Review and version refusals. If an artifact is taken down while its author's account is waiting to be deleted, it stays down even if they cancel the deletion.

Your organisation's Reports page

Reports on an organisation's non-public artifacts go to that organisation, not to staff. Owners and admins see them under the Reports tab: open your organisation from Organisations. For each report, choose Dismiss report (the artifact shows in search again if no other report is open) or Archive artifact.

Comments, community posts and people

In an artifact's discussion and in the Community, press Report on a post. On a community thread, the ⋯ menu has Report thread and Report author. Moderators can hide the post with a warning to its author, restore a post that was reported unfairly, or warn or suspend the person. You can still hide your own comment, and an artifact's owner can hide posts in its discussion.

Account restrictions

Code: account_suspended, account_banned

Staff can suspend an account until a set time, or ban it. While restricted you cannot sign in, and the CLI, MCP server and API refuse your requests with one of these codes.

• Suspended: your public content stays up, and you can sign in again when the suspension ends.
• Banned: your profile and artifacts are hidden. The email address and provider accounts you sign in with are blocked for up to three years, kept only as keyed hashes, so a new account cannot use them. Staff can lift a block on appeal. An unban lifts it too.

Account status shows which applies and the reason. Only staff can lift a restriction. If you think it is a mistake, email the address on that page from the address you sign in with. Do not work around it with another account.