PromptGuard

• 

• 

• 

  FIRST PAGE

• 

  App Icon

Inspiration

I'm a final-year Computer Science student focused on cybersecurity, and my final-year project is a honeypot-based threat detection system — an AI that runs decoy systems and logs how real attackers behave against them. Around the same time, I noticed something: almost every student building an LLM-powered app for this hackathon is shipping a system prompt they've never actually tried to break. Jailbreaks like "DAN" and instruction-override attacks are well documented, but there's no lightweight tool a student can run before shipping to check whether their own prompt is vulnerable.

PromptGuard is that tool — built from the same instinct as my FYP (generate real data about how adversarial input behaves against a system) but pointed at a different attack surface: LLM prompts instead of network services.

What it does

PromptGuard scans a system prompt or user-input string against a library of known jailbreak and prompt-injection patterns — role overrides, DAN-style jailbreaks, instruction overrides, delimiter injection, system-prompt exfiltration attempts, encoding-based bypasses, false-authority claims, and fictional-framing bypasses. For each match, it explains what the technique does and how to fix it.

The Pro tier (gated behind a RevenueCat entitlement) runs a deeper analysis: it generates novel attack variants by combining and obfuscating the matched techniques the way a real attacker would iterate, and produces a hardened rewrite of the original prompt that explicitly closes the vulnerabilities found.

How we built it

React Native + Expo for the app itself — three screens (input, scan results, deep scan), no navigation library, just simple state-based screen switching to keep it lean. A static pattern library (data/patterns.js) of regex-based detectors, each tagged with severity and a fix suggestion — this powers the free tier. A rule-based deep-scan engine for the Pro tier: rather than calling an external LLM (which would mean shipping an API key or standing up a backend in a short build window), I built deterministic logic that analyzes which attack categories matched and constructs both realistic attack variants and a hardened system-prompt rewrite from that analysis. RevenueCat gates the deep-scan feature behind a pro entitlement, checked via Purchases.getCustomerInfo() against a non-consumable product. Built and iterated in Expo Snack for fast browser-based testing, then a separate native Expo dev build (via EAS) for the RevenueCat integration, since react-native-purchases is a native module Snack can't run.

Challenges we ran into

Environment setup ate more time than the actual logic. Getting a clean Expo project structure (avoiding duplicate/misnested files), matching Expo Go's SDK version to the project, and getting an EAS cloud build working all took real trial and error before any app code ran. Deciding what "AI deep scan" should mean under a tight deadline. I originally planned to call an LLM API for novel attack generation, but that meant either exposing an API key client-side (a real security anti-pattern for a security app) or standing up a backend I didn't have time to build reliably. I chose to build genuine rule-based logic instead — it's deterministic and transparent rather than a black box, which is arguably a more honest fit for a security tool anyway. Keeping scope to something finishable. It would have been easy to add accounts, cloud-synced scan history, or a bigger pattern library — I kept it to the smallest version that actually demonstrates the core idea end to end.

Accomplishments that we're proud of

Shipping a fully working end-to-end flow in a short window — input, static pattern detection, and a genuinely functioning deep-scan engine, not a mockup or a stubbed-out feature. Every screen does what it claims to do. Building the deep-scan logic as real, deterministic reasoning rather than faking it. It would have been easy to hardcode a fake "AI result" for the demo — instead, the hardened-rewrite output is actually derived from which attack categories were detected, so it produces different, correct output for different inputs. Getting RevenueCat's entitlement system properly wired into a real native build, including setting up products, entitlements, and the SDK integration from scratch, on a first attempt with this tooling. Making it honestly useful to the exact audience judging it. Half the apps in this hackathon are LLM-powered — PromptGuard is a tool that could genuinely audit other Shipaton submissions, not just a hypothetical use case. Staying scoped. Cutting a live-LLM backend in favor of a reliable, well-reasoned rule-based system was the right call under the time constraint, and the app is better for having something that fully works rather than something bigger that's half-broken.

What we learned

Hands-on experience with the actual mechanics of prompt injection and jailbreak patterns — not just reading about them, but encoding detection logic for each category and thinking through how an attacker would iterate past a first-pass filter. Also a lot of practical experience with the Expo/EAS build pipeline and RevenueCat's entitlement model, both of which I hadn't used before this project.

What's next for PromptGuard

Expand the pattern library beyond the initial 8 categories. Replace the rule-based deep scan with a real backend-mediated LLM call for genuinely novel adversarial generation, once there's time to build it securely. Add scan history so a developer can track how a prompt's risk profile changes as they iterate on it.

Built With

• android
• eas-build
• expo-snack
• expo.io
• javascript
• react
• react-native
• regex
• revenuecat