File Sharing Services Evaluation

Summary

Status: COMPLETED Recommendation: ADOPT Gokapi for self-hosted file sharing Catbox/Litterbox: NOT RECOMMENDED for ops-core use

Hypothesis

Catbox.moe and Litterbox.catbox.moe could provide a simple, API-driven solution for temporary and permanent file sharing needs within the organization.

Result: REJECTED - Catbox fails multiple ops-core compliance requirements. Gokapi selected as self-hosted alternative.

Approach

1. Service Analysis: Document Catbox/Litterbox capabilities, APIs, and limitations
2. Security Evaluation: Assess malware risks, trust scores, and content policies
3. Compliance Check: Evaluate against ops-core requirements (sovereignty, audit, reliability)
4. Alternatives Survey: Research self-hosted options meeting compliance needs
5. Deep Dive: Compare top candidates (Gokapi vs Plik) for final recommendation

Findings

Catbox/Litterbox Service Overview

Service	Max Size	Retention	API	Hotlinking
Catbox.moe	200 MB	Permanent	REST (8 endpoints)	Yes
Litterbox	~200 MB	1h-72h	Single endpoint	Yes

Security Concerns (Critical)

Risk	Severity	Evidence
Malware Distribution	HIGH	SANS documented ~600 abused URLs; .dll bypass
Trust Score	CRITICAL	Scamadviser: 1/100 (Nov 2025)
No Content Scanning	HIGH	Files uploaded unmodified
Extension-Only Filtering	MEDIUM	No content validation

Reliability Issues

Issue	Impact
504/500 Errors	Intermittent service disruption
Funding Deficit	~$1,388/month shortfall
Geographic Blocks	AU, Iran, Afghanistan, Turkey
ISP Blocks	Comcast, Spectrum, Rogers, Verizon, Quad9

Ops-Core Compliance Assessment

Requirement	Catbox	Gokapi
Data Sovereignty	FAIL	PASS
Audit Trail	PARTIAL	PASS
Security Standards	FAIL	PASS
Reliability SLA	FAIL	PASS
Self-Hosted	FAIL	PASS
E2E Encryption	N/A	PASS (Level 3)

Gokapi vs Plik Comparison

Criterion	Gokapi	Plik	Winner
Admin-only Upload	Yes (default)	Configurable	Gokapi
E2E Encryption	Yes	No	Gokapi
OpenAPI Docs	Yes	No	Gokapi
Deduplication	Yes	No	Gokapi
Multi-DB Support	SQLite/Redis	SQLite/PostgreSQL/MySQL	Plik
Streaming Mode	No	Yes	Plik
Oracle ARM Compatible	Yes	Yes	Tie

Outcome

Status: COMPLETED Recommendation: ADOPT Gokapi

Primary Choice: Gokapi

Rationale:

1. Admin-only upload by default aligns with security principles
2. E2E encryption (Level 3) for sensitive files
3. OpenAPI specification enables automation
4. File deduplication improves storage efficiency
5. OAuth2/OIDC support for enterprise authentication
6. Lightweight - ideal for Oracle Free Tier constraints

Catbox Failure Registry

ID	Category	Description
FAIL-001	Security	Documented malware abuse
FAIL-002	Trust	1/100 Scamadviser score
FAIL-003	Reliability	No SLA, funding deficit
FAIL-004	Compliance	Third-party, no control
FAIL-005	Sustainability	Precarious funding
FAIL-006	Access	Geographic/ISP blocks

Next Steps

• Document findings in Knowledge Vault
• Add knowledge register entry
• Deploy Gokapi on Oracle Free Tier (deferred to backlog)
• Configure Nginx reverse proxy
• Generate API key for automation

Artifacts

• Catbox API Documentation
• Litterbox API
• Gokapi GitHub
• Gokapi Documentation
• SANS Stormcast - Catbox Abuse

Related

• ops-core - Governance authority

Timeline

Date	Activity
2026-01-29	Research initiative created
2026-01-29	Catbox/Litterbox analysis completed
2026-01-29	Security assessment: NOT RECOMMENDED
2026-01-29	Alternatives survey completed
2026-01-29	Gokapi vs Plik deep dive
2026-01-29	Final recommendation: ADOPT Gokapi

See also: Research Index