Inspiration
Social engineering attacks are rising, and students are a prime target for bad actors. We’re constantly told to build a network on LinkedIn and social media, but as students we saw a gap between building a brand for yourself and following operational security best practices. No single post gives much away. The danger is how years of harmless posts combine: a pet’s name, a birthday, a parent’s name and a trip are enough to impersonate you to your own family. As graduate students, we find it difficult to sift through our Linkedin messages to separate the legitimate messages from invalid ones.
What it does
Camouflage maps your social engineering attack surface. You upload your own LinkedIn and Instagram data exports, and a one-time code in your bio proves they’re yours. It then shows what a bad actor could learn. Every fact is tied to the exact post or photo it came from. Steps are sorted into Hide (shrink what strangers see), Lock (protect the account itself) and Habit (break the attack in the moment, like a family safe word). Each step is ranked by the points it removes from your score, and the scan reruns when you tick one. We also have the additional functionality to check validity of incoming messages.
How we built it
Exclusively through Claude Code
Challenges we ran into
Limited LinkedIn data. The quick LinkedIn archive only includes a few files, and Positions, Education and Shares need the full archive. We had to build and test on dummy personas first.
Finding solid datasets to support our program. Finding solid use cases for our solution, creating a useful product.
AI output inconsistency. The model sometimes missed facts, guessed wrong, or returned messy results, so we forced strict JSON and had the code drop any fact that didn’t trace back to a real post.
Making it impossible to aim at someone else. Balancing a useful tool with the risk that it could help an attacker, which led to the ownership code and showing only patterns, never ready-to-send messages.
Accomplishments that we're proud of
We were able to develop a hardening system that alerts users to Operational Security gaps in their Social media pages, specifically LinkedIn and Instagram
We were able to include two features in our product.
What we learned
The risk is in the combination of posts, not in any single one.
Sometimes the right fix is a habit, not deleting things: a job seeker needs a public profile, so the fix is learning to verify recruiters.
Building with an AI coding tool works best with small steps, clear specs and frequent commits.
What's next for Camouflage
Other social platform support, a family mode so a whole household can harden together, and a version that universities, libraries and credit unions can offer to their members.
Built With
- claude
