Automated content filtering uses safe defaults

Moderation APIs configured with permissive thresholds (toxicity > 0.9 to flag) will miss the majority of harmful content — most real-world toxic posts score between 0.5 and 0.8. A threshold that's too high means your automated filter is effectively disabled, forcing human moderators to catch everything the system lets through. Under CWE-20, this is an input validation failure: the system nominally validates content but its configuration makes the validation meaningless. Platforms that over-rely on high-confidence thresholds face the same regulatory risk as platforms with no filtering at all.

Set toxicity thresholds conservatively in your moderation config. Flag at 0.5 (review queue), auto-remove at 0.8. Update src/config/moderation.ts:

export const MODERATION_THRESHOLDS = {
  toxicity:       { flag: 0.5, autoRemove: 0.8 },
  severeToxicity: { flag: 0.3, autoRemove: 0.6 },
  insult:         { flag: 0.5, autoRemove: 0.8 },
  identityAttack: { flag: 0.4, autoRemove: 0.7 },
};

Content scoring above the flag threshold goes to the moderation queue; content above autoRemove is hidden immediately pending review. Never ship with thresholds above 0.7 for the flag tier.