JobXray

Inspiration

Students browsing LinkedIn and job boards keep running into outdated or fake internship posts. The fake ones usually follow the same path: a surprise "you've been shortlisted" message, a move into a WhatsApp or Telegram group, a group call, a training pitch, and finally a fee to "confirm your seat." The warning sign people trust most, "they moved me to a WhatsApp group," is only a hunch. I wanted a tool that checks instead of guesses: before you apply, investigate the opportunity.

What it does

JobXray investigates a job or internship offer before you pay, apply, or share anything. You can paste the recruiter's messages, a job link (LinkedIn job and post links work), or up to three screenshots. JobXray then:

• Reads the recruitment funnel: which of six stages appear (offer, recruiter contact, move to a group, group call, training pitch, payment request), each backed by an exact quote from your text.
• Goes to the source: finds the company's real website, confirms it with six identity checks (not a look-alike domain, real homepage, company identity, same-site links, careers section, about/contact), and reads the official careers page to see whether the role is actually listed.
• Challenges itself: before deciding, it looks for evidence that could prove its first verdict wrong.
• Catches what most checks miss: outdated or closed posts, recruiters using personal email, look-alike or form links, requests for an OTP or password, and "get paid to like videos" task scams.

The result is one clear answer, Proceed, Verify First, or Stop, with every reason linked to a quote or an official page. There's no scam score: the AI only reads and quotes, and fixed, testable rules make the decision.

How I built it

I started with the Devpost Learn Skill Pack and planned before writing any code: a scope, a PRD, and a technical spec, then ten small working slices built and verified one at a time with Claude Code.

• Frontend: Next.js, with a dark "X-ray" interface and an animated ThreeUI laser backdrop.
• Backend: FastAPI, using a start-then-poll API so the progress view shows each step live.
• AI: free OpenRouter models. One reads the claims and the funnel, proposes the company's domain, and reads the careers pages; a vision model transcribes screenshots. Each investigation is capped at 4 model calls.
• Web checks: Scrapling fetches the official pages, and its headless browser reads careers pages that need JavaScript. SerpAPI is a cached fallback to find a company's site or a listing when the normal check fails.
• Evidence ledger: every finding is recorded as Fact, Verified, Unverified, Unknown, or Contradiction. Plain Python rules turn the ledger into the verdict.

Challenges I ran into

• The model invents things. It once labelled "Microsoft never charges candidates any fee" as a fee, which turned a real posting into a STOP. I fixed it with a deterministic guard and a test, and every quote the model returns is now checked against the source text.
• Real websites fight back. LinkedIn hides posts behind sign-in walls, many careers pages only load with JavaScript, and a PDF link crashed the scraper. Each one needed its own fix: LinkedIn's public guest views, a headless browser, and file detection.
• Free-tier limits. 50 model requests a day meant planning every live test, adding retries for flaky answers, and caching web searches.
• Not crying wolf. Telling an outdated-but-real post apart from a scam, and never treating "couldn't verify" as proof of fraud.

Accomplishments that I'm proud of

• It works on real cases: an Infosys-impersonation internship with a UPI fee ends in STOP, and a real LinkedIn internship from a small company ends in PROCEED, confirmed on the company's own careers page.
• Every verdict is explainable: no black-box score, just quoted evidence and official sources.
• 171 automated tests, plus safety guards: it never fetches private network addresses and never trusts a domain taken from the scam message itself.

What I learned

• Planning first (scope → PRD → spec → small slices) kept the project from sprawling and made each change easy to verify.
• Let the model observe; let code decide. Keeping the AI's job small and checkable made its mistakes visible and fixable.
• Saved test fixtures prove the rules, but only live runs prove the model's inputs. Several real bugs only showed up against real websites.

What's next for JobXray

• A browser extension that checks a LinkedIn post right where you see it.
• Recruiter checks: matching emails and phone numbers against official channels.
• More job boards, regional languages, and a shared, privacy-safe record of reported scam patterns.

Built With

• fastapi
• next.js
• openrouter
• playwright
• pydantic
• python
• react
• scrapling
• serpapi
• three.js
• typescript