> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moderationapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Spam & Security

> Detect spam, self-promotion, code abuse, phishing attempts, and mask URLs in user-generated content.

Spam and security policies catch content that's trying to manipulate, deceive, or exploit your platform — from low-effort promotion all the way to active phishing and code injection attempts.

For URL-specific risk scoring, see [URL Risk](/policies/url-risk). For lookalike characters and other Unicode evasion, see [Unicode spoofing](/policies/unicode-spoofing).

## Policies

| `id`               | Type             | Supported   | What it does                                                                                                                                            |
| ------------------ | ---------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `spam`             | `classifier`     | text, audio | Spam, repetitive content, unsolicited messages.                                                                                                         |
| `low_quality`      | `classifier`     | text, audio | Low-effort content — too short, heavily repetitive, or duplicated sentences. See [Low-quality content](#low-quality-content).                           |
| `self_promotion`   | `classifier`     | text, audio | Self-promotional content and advertising. <Tooltip tip="In active development. Behavior and accuracy may change.">Experimental</Tooltip>                |
| `code_abuse`       | `classifier`     | text, audio | Malicious code, code injection attempts, and abuse of code features. Useful as a guardrail in front of LLM agents.                                      |
| `phishing`         | `classifier`     | text, audio | Phishing attempts and scam messages. <Tooltip tip="Available as preview.">Preview</Tooltip> Requires conversation context to be enabled on the channel. |
| `url`              | `entity_matcher` | text, audio | Extracts URLs from content and can mask them in the returned content.                                                                                   |
| `unicode_spoofing` | `classifier`     | text        | Lookalike characters, mixed alphabets, invisible characters, and Zalgo. See [Unicode spoofing](/policies/unicode-spoofing).                             |

## Low-quality content

`spam` targets promotional, scam, and templated content. It doesn't catch the other kind of noise: posts that carry no information at all. `low_quality` fills that gap and catches three patterns:

| Pattern            | Example                                                                          |
| ------------------ | -------------------------------------------------------------------------------- |
| Too short          | `ok`, `+1`, a one-word reply below your minimum word count                       |
| Heavily repetitive | `buy buy buy buy now` — few unique words, or the same word repeated back to back |
| Duplicated         | The same sentence or line pasted several times to pad a post                     |

The strongest of the three decides the score, so any one pattern on its own is enough to flag.

Configure it on a channel's **Policies → Spam** page:

| Setting                | What it does                                                                |
| ---------------------- | --------------------------------------------------------------------------- |
| Minimum words          | Content with fewer words than this is flagged as too short. Defaults to `3` |
| Repetition sensitivity | The detection threshold for the repetition and duplication signals          |
| Flagging               | Flag or shadow flag                                                         |

<Tip>
  The policy is fully deterministic — no model runs, so it adds no usage cost and no latency. It's a cheap first line of defense in front of the policies that do call a model.
</Tip>

The minimum word count is a hard rule: content below it always flags, whatever the sensitivity slider says. The slider only affects the repetition and duplication signals.

## Reading the result

```javascript theme={"theme":"nord"}
const spam = response.policies.find(p => p.id === "spam");
if (spam?.flagged) {
  await sendToReview(content);
}

const urls = response.policies.find(p => p.id === "url");
urls?.matches?.forEach(m => console.log(m.match));
```

<Note>
  `phishing` looks at the conversation as a whole, not just the latest message. Enable conversation context on the channel and pass prior turns when you submit content — otherwise the policy can't run.
</Note>

See [Understanding API responses](/content-moderation/acting-on-responses) for the full response shape.