Users can report content and abuse

Without a user-facing report mechanism, victims of harassment, hate speech, and spam have no in-platform recourse. They either suffer the abuse in silence or abandon the platform. Under the EU Digital Services Act (DSA Art. 17), any platform hosting user content must provide accessible flagging mechanisms — failure is a compliance violation carrying substantial fines. Beyond legal exposure, communities without reporting mechanisms develop entrenched bad-actor cultures because there is no friction on harassment. Platforms with DSA compliance obligations that skip this control face enforcement actions, not just poor community health.

Add a report button to every user-content component (posts, comments, messages) and persist reports to a dedicated database table. Backend route:

app.post('/api/reports', authenticate, async (req, res) => {
  const { contentId, contentType, reason } = req.body;
  const report = await db.reports.create({
    contentId,
    contentType, // 'post' | 'comment' | 'message'
    reporterId: req.user.id,
    reason, // 'harassment' | 'hate-speech' | 'spam' | 'other'
    status: 'pending',
    createdAt: new Date(),
  });
  res.status(201).json({ reportId: report.id });
});

The report button must appear on 100% of content-display components — a button on posts but not comments is a failing configuration. Wire the frontend component to POST to this endpoint with the content ID and a reason picker.