DEV Community

Cover image for I built an explicit content filter API for indie devs, and I'd love your feedback
Tabu profile image Jozef
Jozef for Tabu

Posted on

I built an explicit content filter API for indie devs, and I'd love your feedback

#showdev #api #node #startup

Hey everyone,

I'm Jozef. I work as a Product Manager and build side projects in my free time.

A few months ago, I needed a way to filter out explicit and NSFW images for an app. I realized the existing tools, like AWS Rekognition or Hive, target large companies. They have complicated pricing, heavy SDKs, and take too much time to set up for a solo dev trying to pass App Store guidelines.

So I built Tabu. It is an image and video moderation API made for indie developers and small teams.

Here is the tech stack:

  • Machine learning: It uses TensorFlow.js (MobileNetV2) running on my own servers. Inference takes about 200ms.
  • Privacy: Images process in memory and delete instantly. Nothing gets saved.
  • Caching: I added SHA-256 hashing with lru-cache to deduplicate requests. If you upload the exact same image twice, it skips the ML model and returns the cached result.

I need some feedback

I want to improve the product before a larger release. I am looking for a few developers to test it and tell me what is broken or confusing.

  1. Read the docs: Tell me if the setup steps make sense.
  2. Test the API: Get a free key, upload some edge-case images, and see if the caching works.
  3. Check the dashboard: Tell me if the UI is hard to use.

The free tier includes 5,000 requests per month, so you do not need a credit card to try it.

If you have a few minutes, please let me know what you think in the comments. I am here to learn.

🔗 Website
🔗 API Docs

Top comments (2)

Collapse
 
parsai profile image
Parsa Hedayatmehr •

Quick public pass (no account or key): the homepage is clear. Three reproducible fixes: it has no <main> landmark; the docs expose two H1s (the logo H1 is empty); and /docs is 15 px wider than the 1440 px viewport, so it can scroll horizontally. One higher-priority docs question: because image_url and video_url are fetched server-side, please document whether redirects and DNS are revalidated, loopback/private/link-local destinations are blocked, and byte/time/content-type limits are enforced. I did not probe the authenticated endpoint.

Collapse
 
sulejj profile image
Jozef Tabu •

Good catch on the SSRF vector and the UI issues. I've pushed fixes to production for all of them.

For the UI:

  • Wrapped the layout in a <main> landmark.
  • Injected display: none into the Swagger UI config via custom CSS to kill the empty H1 topbar.
  • Added overflow-x: hidden to the docs body to stop the 15px horizontal scroll.

For the server-side fetching (SSRF prevention):
You were right about the SSRF risk. I just rolled out a custom dns.lookup override in a dedicated http.Agent and https.Agent for Axios. It intercepts the DNS resolution phase. Before any TCP connection is initiated, it checks the resolved IP. If it maps to a private subnet (10.0.0.0/8, 192.168.x), loopback (127.x, ::1), or cloud metadata endpoints like AWS (169.254.169.254), it kills the request instantly.

I also added a hard maxContentLength inside the Axios config (5MB for images, 50MB for video) to prevent memory exhaustion. I've updated the OpenAPI schema and README to explicitly document the SSRF blocking and file limits.

Appreciate you taking the time @parsai, if you would have a free time to probe the endpoints and point issues there as well, I will be extremely thankful.