Trust no one. Verify everyone.
GET /api/lookup?hash=...
GET /api/distros
GET /api/distro/{slug}
POST /api/report