From 2ebc10f4e5e6e54e54cec5420d8fbba61c0a501a Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Tue, 8 Sep 2026 12:41:45 +0200 Subject: Initial commit: umbrella design for abusectl An abuse reporting sidecar for phishing mail: parse a flagged message, extract its indicators, resolve abuse contacts, and file the result to a MISP instance and to public abuse channels. This is the umbrella spec, agreed in one design session. Each part gets its own spec before it is built; this settles what the parts share and what would be expensive to change later: the case directory and its manifest format, the redaction rule, the ordering between MISP and the vendors, and how partial failure is recorded. It exists as a separate tool because qtmaildir does no network protocol work by design, and this needs RDAP, three vendor APIs and mail to abuse desks. qtmaildir invokes it by name the way it invokes mailsync.sh, and hosts the review dialog; the two are coupled only by the manifest format and a command name in config. Two properties are recorded as safety properties rather than preferences. Recipient identifiers are never captured, at extraction rather than at submission, so the tool cannot disclose an identifier it was never given; tracking tokens inside URLs are covered, since a parameter value is frequently the recipient's address. And nothing remote is fetched while parsing, because following a link confirms the address is live and fires the tracker. parse is the first part to build: stdlib only, no network, no config, and its output is the format every other part reads. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R --- .gitignore | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .gitignore (limited to '.gitignore') diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..bd7777f --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +__pycache__/ +*.pyc +.venv/ +venv/ +HANDOFF.md -- cgit v1.2.3