Deskshield School

Inspiration

Small hotels put guest payments and reservations on a handful of front-desk PCs, but staff rarely get role-specific security practice. Public reporting on hospitality-targeted phishing (e.g. RevengeHotels / TA558 themes) shows attackers using fake reservations, invoices, CVs, and payment emails. Generic awareness courses exist; reception teams need drills that feel like a real shift — in English and Spanish.

What it does

DeskShield School is a bilingual (EN/ES) static web school. Learners open a School Home catalog, choose a role path, and complete modules. Front Desk is playable today:

Full-shift inbox drill (decide → immediate red-flag feedback)
Pressure remix (shuffled scenarios + soft timer)
Interactive 5-minute playbook (confirm each step, not read-only)
Cert-lite local badge + printable session report when the path is complete

Night Auditor, Reservations, and Manager paths are visible as coming soon. Everything is training only: simulated messages, no malware, no live payment portals, no outbound email. Progress is local / non-verifiable on the device.

How I built it

React 19 + TypeScript + Vite 8 static SPA (no backend, no secrets)
Curriculum-as-data: catalog → path → module → drill
Reusable inbox decide/feedback engine for full-shift and pressure modes
localStorage progress (deskshield-school-v1) with sequential unlock + Continue resume
Sticky training-mode banner (including print view)
Shipped via an iterative school upgrade (foundation → drill shell → catalog/path → modules/cert)

Challenges I ran into

Keeping scenarios realistic for hospitality without reproducing malware or live scam infrastructure
Designing pressure that feels urgent (shuffle + soft timer) without unfair punishment
Honest scope: cert-lite is a local badge, not compliance or audit evidence — that disclaimer had to stay visible
Fitting a Platzi-like school shell into a static SPA under a hard hackathon deadline

What I learned

Role-specific drills beat generic “don’t click links” slides. Bilingual coaching and an interactive playbook matter as much as the phishing examples. A static SPA is enough for a strong first training slice if progress and curriculum stay simple and honest.

What's next

Unlock Night Auditor, Reservations, and Manager paths; manager PDF / LMS packaging; optional human-reviewed AI scenario variants; LatAm Spanish localization QA.