HANNA

Inspiration

Every day, people receive highly sophisticated phishing messages. My own family almost lost their savings to a text that looked exactly like it came from their bank. Scams are getting smarter and harder to detect, and while scammers use AI to attack, everyday people don't have AI to defend themselves. That is why we built HANNA.

What it does

HANNA tackles cybersecurity from three different angles:

1. The Analyzer: You upload a screenshot of a sketchy SMS, email, or website. HANNA reads the image, extracts the links, and gives you a straight answer (Safe, Suspicious, Dangerous) with clear explanations and actionable steps.
2. The Simulator: Protection is not enough; people need to learn. The Simulator uses generative AI to create dynamic, fake phishing scenarios so users can practice spotting red flags in a safe environment.
3. Live Trends: A dashboard that aggregates anonymous reports to show what types of scams are currently spiking in your area.

How we built it

We built the frontend and backend using Next.js and deployed it on Vercel. To make it accurate and avoid AI hallucinations, we designed a multi-step hybrid pipeline:

• Image Processing: Before hitting any APIs, we use the sharp library to compress and resize the uploaded screenshots so they process faster and don't hit payload limits.
• Vision AI Extraction: We used the Qwen/Qwen3-VL-30B-A3B-Instruct model hosted on Featherless AI. We send the compressed image and explicitly prompt the model to extract sender info and URLs into a strict JSON format.
• Deterministic Engine: We built a hardcoded Node.js script that handles the actual security logic. It safely unmasks URL shorteners via HTTP redirects, checks domain registration age using RDAP, and verifies if the domain matches the official brand without ever clicking the malicious links.
• The Judge: We pass the extracted data and our deterministic findings to a final LLM to generate a human-readable verdict.

Challenges we ran into

1. Serverless Timeout Limits: Vercel limits serverless functions to 10-60 seconds. Since Vision AI models can take 15+ seconds to process an image, we frequently hit 504 Gateway Timeouts. We solved this by implementing AbortSignal timeouts in our fetch requests. If the AI takes too long, we catch the error and gracefully fall back to our hardcoded rule-based engine so the app never crashes.
2. Vision Model Formatting: The models kept wrapping the JSON in Markdown block quotes or adding conversational text like "Here is the data you requested". We had to implement robust regex parsing (/json|/g) and strict system prompts to force clean outputs for our backend to read.
3. LLM Hallucinations on URLs: Initially, we asked the LLM to decide if a link was malicious. It hallucinated badly, guessing based on the brand name rather than the actual domain structure. We realized we couldn't trust generative AI for factual security determinations, which forced us to build the deterministic engine for the actual verification.

Accomplishments that we're proud of

Getting the multi-step pipeline (Vision OCR -> Deterministic Check -> LLM Summarization) to execute reliably within the strict serverless time limits. We are also very proud of designing an architecture that gracefully degrades to a rule-based system when the AI layer fails, guaranteeing the user always gets a response.

What we learned

We learned how to orchestrate multiple LLM calls in a single request lifecycle while handling latency. Most importantly, we learned that in cybersecurity, you cannot trust generative AI to make factual security decisions on its own; it must be paired with traditional, deterministic code.

What's next for HANNA

Our main goal is to build a native mobile app with screen-reading and accessibility permissions. This would allow HANNA to scan incoming messages directly and display an overlay warning in real-time, completely removing the friction of manually taking and uploading screenshots. We are also exploring the possibility of syncing our deterministic engine with global real-time phishing databases to cross-reference URLs instantly.

Built With

• css3
• express.js
• featherless-ai
• github
• html
• html5
• javascript
• multer
• next.js
• node.js
• react
• rest-api
• sharp
• tailwindcss
• typescript
• vercel
• vision-language-models