Safelink is our link safety system. When a user clicks an external link in Bluesky, the request goes through our redirect service (go.bsky.app). That service checks the link against rules that moderators have added (block, warn, or whitelist). If a link is blocked, the user sees a dead-end page instead of being sent to a malicious site.
The core problem: When a user clicks a link that hasn't been blocked yet, our system caches the "this link is fine" response globally via the CDN for 7 days. If a moderator later marks that link as malicious, the cached "fine" response continues to be served to all users. The block never takes effect — the request never reaches our service.