A phishing list the community keeps honest
Vev's AI flags. People confirm. A public GitHub repo turns it into a percentage everyone can see and audit — with no server in the middle.
The AI flags
Huma's on-device model scores a site as likely phishing from its URL and its content, and surfaces the warning in the Dynamic Island.
People confirm
Clicking Report confirms a flag. Allow anyway is a deny vote. Real users, not a single authority, decide what's on the list — so false positives self-correct.
GitHub aggregates
A GitHub Action recomputes the feed on every report, turning votes into a confirmed percentage per host. No server — the list is a plain public file.
Off by default, and minimal by design
Reporting is opt-in and manual. Turn it on in Settings under Huma AI; until you do, clicking Report only trains your own local Guard. When you do report, Vev sends just the plaintext host and the AI score — never the full URL, never browsing history.
The feed itself is a public JSON file the browser fetches on a schedule, exactly like the URLhaus threat list. Every entry, and every raw report, is visible on GitHub, so the list can be audited and corrected by anyone.
Questions about the community feed
What is the community feed?
A public, GitHub-maintained list of phishing hosts, each with a real percentage showing how many reports confirmed it. Vev's on-device AI seeds candidates; people confirm them. The browser fetches the list like any threat feed and shows the confirmed percentage when you hit a listed site.
Do I have to share my browsing to use it?
No. Consuming the feed is passive and private. Reporting is entirely separate, off by default, and manual.
What exactly is sent when I report?
Only the plaintext hostname and the AI's score — never the full URL, never your history, never anything about other sites you visited. And only when you have opted in and clicked Report.
Who maintains the list?
A GitHub Action recomputes the list from all reports on every submission, turning confirm/deny votes into a percentage, with a minimum-reports floor so one person can't flag a competitor. Everything — every report and the final list — is public and auditable, and anyone can open a pull request to remove a wrongly-listed host.