Because the hash page can lie too.
GET /api/lookup?hash=...
GET /api/distros
GET /api/distro/{slug}
POST /api/report