Report where trust already lives.
Use the web app, Thunderbird add-on, or MV3 browser extension to send a suspicious message to an operator you know.
Self-hostable reporting infrastructure
Turn suspicious email into intelligence people can act on.
Karst gives people a trusted place to report suspicious messages. It protects the evidence, explains the verdict, connects related reports, and sends reviewed indicators to systems the operator controls.
- 01 Received Bounded message accepted Complete
- 02 Protected Evidence encrypted at rest Complete
- 03 Filtered Personal details removed Complete
- 04 Analysed Authentication & rules checked Complete
- 05 Ready for Review Evidence and findings connected Ready
Review Signal
Sender domain does not match the claimed brand.
What changes
A safer report. A clearer answer. A stronger local picture.
Karst serves reporters and analysts without asking either group to trade away the context they need.
Understand the verdict.
See the authentication failures and detection signals behind a result instead of a context-free red warning.
Turn one report into shared defence.
Analysts connect repeated reports into incidents and campaigns, then publish reviewed indicators through signed outputs.
From inbox to action
Five deliberate steps. No opaque hand-off.
Each service owns one part of the job, with durable queueing and narrow access between stages.
A reporter sends the message
Three shipped clients produce the same bounded report format and status lifecycle.
Ingest encrypts the evidence
The RFC822 object moves to Garage; the pipeline receives identifiers and hashes.
Parsers and filters extract safe signal
Email authentication, URLs, attachments, and privacy-filtered text feed classification.
Analysts make accountable decisions
The console keeps evidence access, overrides, approvals, appeals, and audit history together.
Reviewed intelligence leaves
Signed webhooks and local blocklists carry useful indicators without exporting the reporter.
A visible trust boundary
The message body stays out of the pipeline.
Karst stores encrypted RFC822 evidence in a dedicated object vault. Workers exchange a report ID, evidence pointer, hashes, and bounded structured signals—not the message body itself.
- Classifier rules read the server-side privacy-filtered body from PostgreSQL.
- Evidence access is an explicit analyst action recorded in the audit chain.
- Retention classes and legal hold govern when vault objects may be removed.
- Each deployment keeps its own database, object store, broker, and secrets.
Private zone · encrypted at rest
Original RFC822 evidence
report ID · object key · hashes
body does not cross →
Processing zone · service ACLs
Parsed, filtered, reviewable signal
Implementation status
Useful now. Honest about what comes next.
Architecture documents describe the full destination. This split reflects the code that is implemented and locally verified today.
The reporting and review core
A working local stack covers collection, privacy filtering, rules-based classification, campaign analysis, analyst review, retention, and selected outputs.
- Reporter surfacesWeb app, Thunderbird, and MV3 extension
- No-store inspectionAnonymous analysis in an isolated, credential-free service
- Detection pathMail parsing, deterministic rules, and fail-closed privacy NER
- Analyst operationsTriage, evidence, appeals, approvals, campaigns, and audit
- Published outputsSigned webhooks and Local blocklists
- Operational baseDocker Compose, monitoring, retention, and encrypted backups
The release and federation work
These capabilities remain design intent or require target-operator evidence. They are not presented as available product features.
- Classifier qualityA real promoted classifier model and production shadow evidence
- Federation channelsMISP and STIX/TAXII implementations
- Additional clientsNative mobile share extensions
- Deployment proofOperator DNS, TLS, identity, restore, and alert drills
- OrchestrationHelm packaging after the Compose path is stable
Single-tenant by design
Your infrastructure. Your evidence. Your decisions.
Every operator runs an isolated Karst instance. There is no shared SaaS control plane and no cross-tenant database boundary. Docker Compose is the current deployment path, with the services and observability needed to operate the stack together.
karst / deployment
- PostgreSQLdomain state + audit
- Garageencrypted evidence
- NATS JetStreamdurable service flow
- Analyst consolereview + control
- Prometheus stackhealth + alerting
Check the message in front of you.
The Email Inspector analyses one message in memory without filing a report, storing evidence, or dispatching intelligence.