Abuse Reports

Abuse reporting lets a visitor of a public NocoDB page report it for phishing, a scam, impersonation or other misuse. NocoDB stores each report and emails the super admins of your instance, or an address that you set. One reported page gives one email in 24 hours by default. The reporter does not need an account.

Reporting is on by default, on the pages that anyone can open without an account: a shared view, a shared form, a shared interface, a shared dashboard and a shared artifact.

What a visitor reports

A visitor opens the report form with the Report abuse link on the public page. The form asks for a name, an email address, a reason and a description of the problem. The description must have 100 characters or more, so that a report says enough to act on.

The reasons are Phishing or credential harvesting, Scam or fraud, Impersonation, Malware or harmful links, Illegal content, Spam and Other.

The email gives the reason, the description, the reporter and the public address of the page. On the Enterprise Edition it also names the workspace that owns the page. Links in it are broken up, for example hxxps:// and [.], so that a malicious link cannot be clicked by mistake.

Set the recipients

Only a super admin can change these settings.

Go to Admin Panel > Settings.
Find the Security section.
In Abuse contact email, enter the address that receives the reports.

When the field is empty, NocoDB emails every super admin of the instance.

The same section has the Allow visitors to report public pages for abuse checkbox. Clear it to remove the Report abuse link from all public pages. The API then refuses new reports too.

The instance must be able to send email. Configure an email plugin, such as SMTP, MailerSend or AWS SES, from the App Store. Without one, NocoDB stores a report but notifies nobody.

Review reports

Super admins work through the reports in Admin Panel > Abuse reports. The sidebar entry carries the number of open reports. Only super admins see this section.

Filter the list by Open, Resolved or Dismissed. Select a row to open the report. A report shows the public link and whether it is still live, the reason and the description that the reporter gave, and the accounts behind the item: its Owner, its Creator and the Base owner.

Action	What it does
Disable link	Turns the public link off for everyone, and resolves every open report about that item. It covers shared views and forms, interface pages, dashboards and artifacts. The owner can share the item again, which gives a new link.
Block user	Signs the account out everywhere. The account can no longer sign in or use its API tokens. You cannot block yourself or another super admin.
Mark resolved, Dismiss, Reopen	Changes the status of the report. A resolved report records who resolved it and when.

A blocked account shows a Blocked badge in User Management. To restore it, select Unblock user in its Actions menu, or on the report.

Good to know

NocoDB sends one email for each reported page in 24 hours. A later report for the same page in that time is stored, and no second email goes out. Change the period with NC_ABUSE_REPORT_NOTIFY_COOLDOWN_SECONDS, or set it to 0 to get an email for every report. The period starts only when an email goes out, so a failed send is retried on the next report.
Behind a reverse proxy, set NC_TRUST_PROXY so that NocoDB sees each visitor's own IP address. Otherwise NocoDB treats all visitors as one, and a few reports can stop others from reporting the page.
On NocoDB Cloud, these settings are not available. Reports from a page on NocoDB Cloud go to NocoDB.

Availability

Abuse reporting is available on NocoDB Cloud and on self-hosted deployments. The settings on this page are for self-hosted instances only.
The Community Edition covers shared views and shared forms. Shared interfaces, dashboards and artifacts are reportable on Enterprise Edition deployments.