Inspiration
Our inspiration doesn't have a name, a LinkedIn, or a keynote.
It's the person at 11:40 p.m. who taps "Start free trial" and genuinely means to cancel it tomorrow. It's the mother comparing two cart totals and quietly wondering why the second one grew. It's the shop owner who wants to run an honest business but keeps being told that honest doesn't convert.
We are inspired by the moment an invisible thing gets a name. Dark patterns are not dramatic — they are small, polite, and everywhere. A greyed-out cancel button. A countdown that resets. A box already ticked. Nobody sees them, so nobody objects. The instant you can point at them and say "that one, right there, that's a dark pattern" — they lose their power.
That's what inspires us: giving ordinary people the vocabulary and the proof. Not to punish businesses, but to make honesty the easier choice. We'd rather celebrate a clean checkout than shame a bad one.
We are four freshmen who got tired of hearing "read the fine print" and decided to write the tool that reads it for you.
What it does
DarkPattern Auditor is a consent-based web app that scans a business's own website for dark patterns and hands back a compliance report.
A business signs up, submits its own URL, ticks a mandatory consent box confirming it owns or is authorised to test the site, and runs a scan. The scanner opens the real, rendered page and checks for five specific patterns:
- Pre-ticked add-ons
- Hidden costs
- Fake urgency
- Hard-to-cancel flows
- Manipulative wording
Each finding arrives with a severity level, the evidence from the page, and a suggested fix. Everything is saved to a dashboard of sites and scan history, and the whole report downloads as a PDF the business can hand to a lawyer, a client, or a regulator.
And the boundaries are written on the box, not hidden in the terms:
- It never logs in to a site, never submits a form, and never places an order.
- It only ever looks at what the page already shows.
- Every result is automated screening, not legal advice.
The goal is simple: turn an intimidating regulation into a checkbox, a scan, and a PDF.
How we built it
We built the smallest honest version of the idea — five checks, no more. A tool that measures honesty should be honest about itself.
The stack was chosen for one reason: four freshmen could understand all of it.
| Layer | Choice | Why |
|---|---|---|
| Backend | Flask (Python) | Small enough to read end-to-end |
| Database | SQLite + SQLAlchemy | Zero setup, no ops team needed |
| Auth | Flask-Login, Flask-WTF, Werkzeug hashing | Safety by default, not by heroics |
| Scanner | Playwright (headless Chromium) | Reads real, rendered pages |
| ML | scikit-learn (TF-IDF + Logistic Regression) | Explainable, not a black box |
| ReportLab | Clean, printable compliance reports |
We wrote the consent flow before a single line of the scanner — because a tool that audits ethics has to be ethical itself. Then we built a demo store with a dark mode and a clean mode, so we could prove the scanner wasn't just agreeing with us.
AI sat on both sides of this project, on purpose.
Inside the product, the wording check runs on an explainable classifier — scikit-learn with TF-IDF features and Logistic Regression. We chose an explainable model over a more powerful opaque one deliberately: when the tool says "this line is pressure-selling," it has to show exactly which words triggered the flag. A compliance tool that says "the AI decided" is worthless in an argument with a regulator.
Beside the product, AI was our translator — not our author. We knew the logic: the checks, the consent flow, the scoring, the report a shop owner actually needs. We didn't yet know the syntax. AI converted our reasoning into Flask routes, Playwright flows, and ReportLab layouts, and let us move at a speed raw experience couldn't reach.
But every decision stayed ours. Which patterns to check. How to weight severity. Why consent comes before scanning. Why we never touch a cart. AI could write the code. It could not decide what was right to build.
Challenges we ran into
We didn't know how to code. We were college freshmen. This is the challenge people expect to be a weakness. It became the opposite. With no years of habits telling us "that's just how it's done," we reasoned straight from core logic. We knew a subscription should be as easy to cancel as it was to start — so we built a check for asymmetric effort, not for whatever a senior dev would've written. The constraints we lacked meant the assumptions we never inherited.
We couldn't write code fast, so we had to think first. Each teammate became a specialist out of necessity — one on auth, one on the scanner, one on the dashboard and PDF, one on tests and the demo store. That forced us to define interfaces before implementation. We were doing architecture by accident, and it turned out to be the right instinct.
We kept discovering that "scanning a website" is a much bigger claim than it sounds. Dynamic pages, redirects, pages that only render with JavaScript. We didn't lower the bar — we named our limits out loud: up to five reachable pages, approximate wording detection, checkout-only patterns visible only when the page itself shows a cart.
We disagreed. A lot. On severity scoring. On how many checks. On whether the classifier should be "smarter." Those arguments forced us to write down why every decision was made — and those written reasons are now the strongest part of the project.
Accomplishments We're Proud Of
- We shipped a real product as freshmen. Not a mockup, not a slideshow — a working app with auth, a live scanner, a database, and downloadable PDF reports.
- We put ethics in the architecture, not the footer. Consent is mandatory before any scan. The tool never logs in, never submits forms, never places orders. It audits ethics and behaves ethically in the same breath.
- We chose explainable AI over impressive AI. Our classifier shows its evidence instead of hiding behind a black box — because a compliance tool must be defensible, not just confident.
- We turned a 2023 regulation into a checkbox, a scan, and a PDF — something a six-person brand can actually use, no lawyer required on day one.
- We said what we can't do. We documented our limits clearly and framed every output as automated screening, not legal advice. In a field built on catching dishonest design, being honest about our own edges is the whole point.
- We built a demo store to try to prove ourselves wrong. A dark mode and a clean mode on the same URL — so the scanner had to earn its verdicts. ## Accomplishments that we're proud of
What we learned
- Flask taught us that a project is a conversation, not a monolith — routes talk to templates, templates talk to data, and auth quietly guards all of it.
- Playwright taught us that "the web" is a moving target. You can't grep a rendered page; you have to open it like a human would.
- scikit-learn taught us the honest limits of AI. A small classifier can flag manipulative wording — but it will never be a lawyer, and pretending otherwise would be the real dark pattern.
- ReportLab taught us empathy for the reader. A scan is worthless as JSON. Severity, evidence, fix — that's what a shop owner can act on.
- We learned that reading documentation is a skill, not a talent — and a skill can be learned in one semester.
- And we learned the biggest lesson of all: the problem is the hard part, and the code is just how you say it out loud.
We had the logic. AI helped us learn the language. The judgment stayed ours.
Log in or sign up for Devpost to join the conversation.