Feed the rat
URL, mystery, product, question. The rat either starts a file or sends it back. A start is not a finding. Private hosts, logins, and personal data get rejected and are not stored.
Empty cheese gets rejected. Homepages everyone already knows get rejected. A strange public door gets an investigation id.
Stored in data/submissions.json when this machine can write. On a read-only host the tray is ephemeral. Either way the verdict comes back.