PhishGuard

PhishGuard: An AI-powered cybersecurity companion that instantly detects phishing URLs and emails, explaining threats in plain English.

Comment

"Your real-time, AI-powered heuristic shield against deceptive links and social engineering tactics."

  1. About the Project

🌟 What Inspired Us Phishing remains the single most common vector for security breaches worldwide, accounting for over 80% of reported cyber incidents. Traditional defences rely on static blocklists and signature-based databases. While effective against known threats, these databases fail entirely against "zero-day" phishing links—newly registered domains or custom-crafted, highly personalised email scams that exist for only a few hours. We were inspired to build PhishGuard to fill this gap. Instead of looking up URLs in a list, we wanted to build a tool that thinks like a professional security analyst. By parsing the actual structure, linguistic cues, typosquatting indicators, and obfuscation patterns of URLs and emails, PhishGuard exposes threats before they make it onto security blocklists.

🛠 How We Built It PhishGuard is designed as a modern, high-performance, full-stack application built to deliver instant threat assessments: The Intelligence Engine: We integrated the @google/genai SDK using a server-side API proxy to keep API keys fully secure. We utilised the Gemini model with highly strict system instructions and native structured output modes (responseSchema). This guarantees that every analysis is returned in a consistent, clean JSON structure, detailing the risk score, risk level, specific threat vectors, and confidence metrics. The Frontend Workspace: Built with React and styled with a custom Tailwind CSS premium slate-dark palette. It supports effortless toggles between URL and email scanning, sample templates for quick testing, and a persistent local scan log. Resilience & Reliability: To address potential network overloads or temporary API rate limits, we integrated client-side automatic retry routines. If a temporary server bottleneck is encountered, the app handles it gracefully in the background, updating the user dynamically before failing.

💥 Challenges We Faced Maintaining Deterministic Outputs: When parsing security metrics, standard LLM text completions can be unpredictable. We overcame this by enforcing Gemini's strict structured JSON schema configuration, ensuring the output matches our exact format every time without needing fragile regex parsers. Handling Transient API Bottlenecks: During high traffic or peak demand, API endpoints can return temporary 503 Service Unavailable signals. Rather than letting the scanner crash or show a dry error, we designed an elegant client-side retry routine that attempts up to 3 scans with a 2-second delay, keeping the user informed without freezing the UI. Environment Sandboxing: Running inside a sandboxed iframe meant handling browser environment variables and standard library overrides with extra care. We implemented custom native wrapper safeguards in the application's root to prevent conflict with standard browser APIs.

🎓 What We Learned Structured Output Optimisation: We mastered the art of defining clean schema boundaries for generative intelligence, ensuring unstructured data translates into standard, reliable dashboard inputs. Calibrated Risk Management: We learnt how to carefully direct heuristic rules to avoid false positives—calibrating the model to choose "Medium Risk" rather than "High Risk" when warnings are vague, which is critical for user trust in cybersecurity tools.

Built With

Share this project:

Updates