Haven

Haven turns any scary text, email, or DM into a plain-English answer and tells the user if their message is safe or a scam in seconds. This was built to protect the people who need it most.

Comment

Inspiration

A relative gets a text. "Your package couldn't be delivered. Tap here to reschedule." The link looks close enough to the real thing that a busy person taps without thinking twice. Or the message is worse: "Grandma, it's me. I'm in trouble; don't tell Mom, just send this gift card code." Scammers don't target the careless. They target people mid-task, tired, trusting, or unfamiliar with what a fake login page looks like. Those people are usually the ones least likely to catch it themselves. We wanted something a person could reach for in that exact moment of doubt. Not a security app they'd have to learn. Not a form to fill out. Just paste the message and get a straight answer.

What it does

You enter a text message, an email, or a screenshot of a direct message into Haven. You receive a verdict in about a second and a half: scam, probably safe, or exercise caution. There are two to four specific, plain-language justifications for each verdict. Not "urgency indicators detected." For example, "This link goes to usps-trackdelivery.icu, not the real USPS website." Older parents and grandparents, who did not grow up online, are often the most vulnerable to scammers and are unlikely to install a scam checker on their own.

How we built it

Haven uses two layers rather than a single AI call that acts as though it can do everything. The first layer is a quick scan that follows rules. Urgency language ("act now" and "final notice"), requests for payment via gift cards or wire transfers, links that don't match their display text, and domains designed to resemble genuine brands are among the things it looks for. However, we didn't stop at warning of danger. We created a second set of rules that look for proof that a message is legitimate, such as actual order numbers, a sender domain that matches, and a typical "reply STOP to unsubscribe" footer. We then negatively weighted those against the danger score. Since bank alerts are urgent by nature, a system like this would label all genuine bank alerts as scams without that second half. The majority of gullible scam detectors fall into this trap. An AI classifier makes up the second layer. We feed it the raw message as well as everything found by the rules layer, and we ask it to reason about intent rather than just pattern-match keywords. This layer is what detects a simple "hey, is this Jake?" text with a follow-up that gradually evolves into a request for money. That message looks fine to the rules layer. There's no link, no urgency, and no payment request. The AI layer still detects it because it understands where the conversation is heading. We built this on Next.js and TypeScript, deployed through Vercel. The classification pipeline runs on Claude and Gemini. We made a deliberate decision early on in the design process to avoid the typical security-tool look, with dark backgrounds, terminal green, and lock icons everywhere. Someone who uses this tool is usually already anxious. A screen that looks like a hacker's dashboard makes that worse. We built Haven to feel light and calm instead.

Challenges we ran into

Testing this thoroughly revealed three real bugs, not the hypothetical edge cases we had imagined in advance. The first was a Unicode issue. In order to detect lookalike domains, our own code normalized a Cyrillic character set. This allowed a fake domain that was designed to visually resemble PayPal's actual website to be transformed into the authentic paypal.com string and then credited as safe and verified. Creating a new type of spoof was the precise method intended to detect spoofing. The second was a privacy leak. The AI layer began quoting people's credit card numbers and social security numbers back into its own written explanations as soon as we connected a real API key. We hadn't noticed this before because a missing key had quietly pushed every test through the rules-only path, which never returns the input text. The bug was present the entire time. We couldn't see it until the AI layer was turned on. The third appeared when our API credits ran out mid-build. The rules-only fallback used the complete lack of red flags as evidence that a message was secure in that degraded state. That is not correct. A message with no link, urgency, or payment request is not always safe; in fact, it is frequently the opening message of a patient scammer. Our most difficult test case, a wrong-number romance-scam opener with no rule-based signals, returned "looks legitimate" during that timeframe. We caught it, changed the scoring logic so that safe verdicts required actual positive evidence, and reran everything to confirm.

Accomplishments that we're proud of

We run 16 real message examples in our test suite, which include both legitimate messages that might appear suspicious at first glance and common scam patterns. We are currently at 16 out of 16. No genuine scams were deemed safe, and no legitimate messages were reported as fraudulent. The typical response time is approximately 1.5 seconds. Additionally, we take pride in the fact that, through adversarial testing, we discovered all three bugs earlier on.

What we learned

The AI classification was never the difficult part. The difficult part was everything else: what happens when an API call fails, what is logged versus what should never be stored, and how a tool designed to detect deception can be replicated by the same tricks, such as Unicode spoofing, that it is supposed to detect. We also discovered that tone is not only a design choice, but also a security one. When a user interface is calm, they are more likely to pause and review a message before responding. That pause represents the entire product.

What's next for Haven

Real-time account infrastructure and persistent storage, which is currently running on a lightweight local store for demonstration purposes. Instead of the current simulated version, we'll show live SMS and push notifications for family alerts. Support for languages other than English. And continuous detection that adapts to changing scam patterns without requiring any changes to the AI's rules layer.

Built With

Share this project:

Updates

Submission history