CheckSafe

Inspiration

Every single day, millions of people receive urgent, threatening, or confusing messages on their phones. A fake parcel waiting, an alleged bank compromise, an emergency money transfer. In these moments of uncertainty, people hesitate, panic, and often make costly mistakes. Traditional cybersecurity tools are either too technical (explaining DNS records or packet headers) or completely silent. We wanted to build a human-first safety companion that turns anxiety into clarity, designed for someone's grandparents as much as for digital natives.

What it does

CheckSafe is a privacy-first, offline-resilient scam and phishing explainer. When a user pastes a suspicious message (SMS, email, WhatsApp), CheckSafe:

1. Evaluates the risk (Low, Suspicious, Very dangerous).
2. Highlights exact traps word-for-word, while safely defanging any malicious links (hxxp://...).
3. Provides 3 jargon-free, immediate actions to protect the user.
4. Suggests the Verified Official Portal: If a brand is impersonated (e.g., Amazon, DHL, PayPal), it provides a safe, green button pointing to the verified official website so the user doesn't click the malicious link.

How we built it

We prioritized Trust & Responsible Design at every step.

• Frontend & Backend: Next.js (App Router) and Tailwind CSS deployed on Vercel.
• AI Engine: Powered by Google Gemini (Flash) with an automated, seamless fallback to Groq (Llama 3.3) for 100% uptime.
• Zero-Data Privacy: Before the message ever leaves the browser, a client-side PII redactor scrubs phone numbers, emails, IBANs, and financial amounts ([PHONE], [EMAIL], [AMOUNT]). Users can click "See exactly what is sent" to verify this transparency.
• Reliability: We engineered a CI/CD pipeline with GitHub Actions, 112 passing automated tests, and a scheduled Production Smoke Test running every 6 hours to ensure a scam is never misclassified as safe.

Challenges we ran into

One major challenge was the "Absence of proof isn't proof of safety" dilemma when the app goes offline. If a user loses internet or the APIs fail, we implemented a Local Fallback Engine using Regex and heuristics. However, we made a strict design choice: the offline engine can only flag a message as Suspicious or Very dangerous. If it finds nothing, it returns Undetermined instead of Low risk. We refuse to give a false sense of security.

Another challenge was neutralizing malicious links without breaking the AI's ability to analyze them. We had to build a custom defanging module that works both on the client and server to guarantee malicious URLs are never rendered as clickable <a> tags.

Accomplishments that we're proud of

• Client-Side PII Masking: Giving users verifiable proof that their private data isn't being scraped.
• 112 Automated Tests: Achieving professional-grade software reliability in a hackathon timeframe.
• The "Share to a loved one" feature: A 1-click WhatsApp/SMS button that formats the safety verdict so users can easily protect their vulnerable family members.

What we learned

We learned that explaining why a message is dangerous (identifying psychological manipulation like "artificial urgency") is far more effective than just flashing a red warning sign. Transparency builds trust.

What's next for CheckSafe

We plan to introduce a Web Share Target (PWA) so users can directly forward a text message from their phone's native SMS app to CheckSafe without needing to copy/paste.

⚠️ Honest Limitations (SafeSpace Requirement)

CheckSafe focuses on social engineering patterns, behavioral traps, and semantic analysis. It does not inspect network packets, server-level SPF/DKIM records, or perform live malware scanning of attachments. It is designed to act as an immediate "second opinion" for human-targeted manipulation, but it should never replace direct verification with official authorities or emergency services.

Built With

• github-actions
• google-gemini
• groq
• javascript
• next.js
• react
• tailwind.css
• vercel