PUBLIC (no auth) — tell us this shared page is wrong.

A share page carries a member's own words on our domain, readable by anyone holding the link. So the report door has to be open to anyone holding the link too: no account, no login, no email.

A report never removes anything. It files a flag an admin reads and decides on. Auto-hiding on report would hand every stranger a takedown button for someone else's honest receipt — the exact opposite of the product.

Order mirrors /v1/feedback and /v1/waitlist: per-IP rate limit FIRST (this is an anonymous write), then shape, then the save.

The answer is identical whether the token is real, unknown, revoked, or already flagged. GET /v1/share/{id} deliberately 404s the same way for an unknown and a revoked token so nobody can discover which links exist; an honest 404 here would undo that and turn the report route into a token oracle. A report against a token we can't resolve is thanked and dropped.

Unknown reason values become "other" and an over-long note is TRIMMED — never a 400. Somebody flagging abuse for us is doing us a favour, and arguing with their form is how you stop hearing about it.