Harassment and blocking features are available

Platforms without block and mute features leave users with no way to protect themselves from targeted harassment. CWE-285 (Improper Authorization) applies when there is no mechanism preventing a specific user from contacting or interacting with another. COPPA 16 CFR 312.4 requires that platforms collecting data from minors provide parental control mechanisms — blocking is the foundational user-level control. Without blocking, a single bad actor can repeatedly mention, message, or comment on a victim's content with no platform-enforced boundary, and moderators cannot act fast enough to prevent sustained harassment campaigns.

Implement a blocks table and enforce it across all interaction paths: messaging, commenting, and mentions. Every interaction endpoint must check block status before allowing the action:

async function assertNotBlocked(actorId: string, targetId: string) {
  const block = await db.blocks.findFirst({
    where: {
      OR: [
        { blockerId: targetId, blockedId: actorId },
        { blockerId: actorId, blockedId: targetId },
      ],
    },
  });
  if (block) throw Object.assign(new Error('Blocked'), { status: 403 });
}

A block that prevents messaging but not commenting or mentioning does not satisfy this check — every interaction path must respect the block.