Description text scanned for SEO spam patterns before entering review queue

Keyword stuffing, excessive link insertion, and spam phrases in listing descriptions are direct attacks on your directory's search ranking and user trust. If they reach the public index, search engines penalize your domain; if they reach users, they damage the directory's reputation as a quality resource. CWE-79 (XSS) applies when unscanned descriptions contain injected script tags. OWASP A03 covers the broader input trust failure. Automated detection gates the moderation queue so human reviewers see pre-filtered content.

Scan descriptions for keyword stuffing, excessive links, and known spam phrases before queuing. Flag — do not auto-reject — suspicious submissions so human review remains the final gate:

// lib/spam-detector.ts
export function detectSpam(text: string): { flagged: boolean; signals: string[] } {
  const signals: string[] = []
  const words = text.toLowerCase().split(/\s+/)
  const freq = words.reduce<Record<string, number>>((acc, w) => {
    if (w.length > 3) acc[w] = (acc[w] ?? 0) + 1
    return acc
  }, {})
  for (const [word, count] of Object.entries(freq)) {
    if (count >= 5) signals.push(`keyword-stuffed: "${word}" ×${count}`)
  }
  const links = (text.match(/https?:\/\/\S+/g) ?? []).length
  if (links > 5) signals.push(`excessive-links: ${links}`)
  for (const phrase of ['buy now', 'click here', 'cheap', 'act now']) {
    const n = (text.match(new RegExp(phrase, 'gi')) ?? []).length
    if (n >= 3) signals.push(`spam-phrase: "${phrase}" ×${n}`)
  }
  return { flagged: signals.length > 0, signals }
}

Record spam_signals as a JSONB column on the listing row so moderators can see exactly what triggered the flag.