Crowd Intel

Crowd Intel (optional)

secwatch has an opt-in, self-hostable crowd-intelligence layer: installs can share confirmed bans with an aggregator and pull a consensus blocklist so each install makes the others stronger. It's off by default.

See also CROWD.md in the repository for the full privacy + threat model.

What is shared (and what isn't)

When sharing is on, secwatch reports only: the attacker's IP, the rule that tripped, and a timestamp. It does not share your traffic, your paths, your hostnames, or any of your data.

Client config

crowd:
  enabled: true
  url: https://your-aggregator.example.com
  token: "shared-token"
  share: true      # report my confirmed bans upstream
  consume: true    # pull + apply the community blocklist
  ban_ttl_hours: 72

• share and consume are independent — you can contribute, consume, or both.
• Consumed IPs are applied as expiring community bans and are never re-reported.
• Only public IPs are ever shared or consumed.

Running your own aggregator

The aggregator is self-hostable — you don't have to trust anyone else's:

SECWATCH_AGG_TOKEN=your-secret python -m secwatch.aggregator

It exposes a token-gated POST /report and a GET /blocklist that only returns IPs reported by at least N distinct reporters (consensus), is rate-limited, and accepts public IPs only. Tune consensus and windows with SECWATCH_AGG_* environment variables.

Why opt-in

Crowd intel is powerful but it's your call whether to participate. Everything here stays off until you set crowd.enabled: true, and you can point at your own aggregator so no data leaves infrastructure you control.