Shieldio

• 

  RISKY

• 

  MEDIUM

• 

  FAQ

• 

  FORM

• 

  FULL PAGE

• 

  TITLE

• 

  RESULTS

Inspiration

A sponsorship offer can look like a creator’s next big opportunity while hiding a request that puts their account, device or money at risk. Shieldio started with a simple question: how can creators check an offer before they click, pay or share anything?

We wanted to make that pause useful by showing clear evidence and practical next steps.

What it does

Shieldio helps creators inspect sponsorship emails and DMs. Users paste an offer and can add the sender’s email, the brand name and a website they already trust.

The app checks sender and link domains, identifies potentially executable filenames, and uses Gemini to examine messages for payment traps, credential requests, impersonation and pressure tactics.

Results include quoted evidence, a caution level, verification steps and a draft reply. Users can copy the results or export a Markdown report.

How we built it

We built the interface with HTML, CSS and JavaScript, with a Node.js API deployed on Vercel. Gemini returns structured JSON containing findings, quotations and verification steps.

Code handles domain comparisons and filename checks. Before displaying an AI finding, the server checks that its quotation appears verbatim in the submitted message. Unsupported quotations are discarded.

The caution level follows the highest severity among the supported findings:

$$ r = \max\left({0} \cup {s(f) : f \in F}\right) $$

Here, F is the set of supported findings, and severity values 1, 2 and 3 represent low, medium and high concern. A value of 3 produces “High caution”; 2 produces “Verify first”; 0 or 1 produces “Few indicators found.” These are ordinal categories, not probabilities of fraud.

The Gemini key stays on the server. Shieldio does not save submitted offers or open suspicious links and attachments.

Challenges we faced

Avoiding false certainty was a central challenge. An agency may legitimately use a different domain, and a message without obvious warning signs may still be fraudulent. Shieldio recommends verification rather than declaring an offer safe.

We also needed to keep AI explanations grounded in the input. Exact quotation checks help reject invented evidence, although a valid quotation does not guarantee a correct interpretation.

Testing caught a filename detection issue: ordinary .com website addresses could be mistaken for executable filenames. We corrected it and added a regression test.

What we learned

AI interpretation and deterministic checks work well together. Code provides consistent domain comparisons and evidence validation, while Gemini helps interpret context and suspicious requests.

Security tools also need to explain their limits. Showing why something deserves attention—and how to verify it—is more useful than presenting an unexplained score.

Accomplishments and next steps

We shipped a public working app, three fictional examples, report export and a public GitHub repository. Six automated tests and four live analysis scenarios passed.

Next, we would evaluate Shieldio against a broader labelled dataset, improve false-positive handling, add stronger shared rate limiting and explore email authentication checks.

Our goal is to help creators make better verification decisions before a risky interaction.

Built With

• google
• html5
• python