RealCheck

Inspiration

Deepfakes and scam messages are getting convincing enough that "just look closely" isn't a real defense anymore. We noticed most detection tools collapse two different questions into one score , is this file manipulated, and is this message trying to manipulate you. Those need separate evidence, not one confidence number.

What it does

RealCheck checks uploaded images/audio against Reality Defender for signs of manipulation, transcribes audio via Groq, and reviews the message wording separately for scam/social engineering patterns , so a real recording carrying a scripted lie still gets flagged. It runs as a website and a Chrome side panel for inline checking while browsing.

How we built it

Node.js backend, vanilla JS frontend, hosted free on Render with a custom domain. Quota is enforced with Upstash Redis ,atomic admission across concurrent requests, fail-closed if Redis is unreachable, so a broken quota store blocks scans instead of silently letting them through.

Challenges we ran into

Getting providers to fail honestly was harder than getting them to work. Reality Defender sometimes returns an SDK status we have no verdict mapping for ,we refused to invent one, so the UI surfaces the raw status instead of hiding it. A bad Groq API key threw 401s that the frontend was masking as a generic "internal" error, so we rebuilt failure-code handling end-to-end ,RD adapter, worker, API, UI , without ever leaking secrets in the process. We also broke our own Redis ledger mid-hackathon by deleting a key directly instead of using the init script, which cost us a scramble to recover it safely.

Accomplishments that we're proud of

Failures in RealCheck tell the truth. No provider error gets papered over as a generic message, and the quota system fails closed rather than fails open both choices that are easy to skip under hackathon time pressure but matter for a tool whose whole job is trustworthiness.

What we learned

Debugging distributed failure states across a worker, adapter, API, and UI taught us more about honest error propagation than the detection logic itself did. Also: never delete a production key directly when there's an init script for a reason.