Red Team by Showcify

Get rejected here first: three AI hiring judges read your resume against the job post and tell you every reason they'd say no with exact quotes and how to fix each one before you apply.

Comment

Inspiration

Rejection emails tell you nothing. You spend an hour on an application, wait two weeks, and get: "We decided to move forward with other candidates." The real reasons stay hidden i.e. a recruiter skimmed past your headline in six seconds, an ATS never matched the keywords, a hiring manager didn't believe a claim on line three.

I am the founding engineer of Showcify, a AI-powered job-seeker platform. The most painful thing job seekers deal with isn't writing resumes. It's silence. So we built the opposite of silence: a tool that rejects you first, to your face, with receipts while you can still fix it.

Get rejected here first.

What it does

Red Team is a Chrome side panel. Open any job posting, click once, and three hostile AI reviewers read your real resume against that posting:

  • a recruiter with six seconds and 200 other applications open,
  • an ATS keyword screen checking requirement by requirement,
  • a skeptical hiring manager protecting their team's time.

Each reviewer returns named rejection reasons. Every reason comes with an exact quote from your resume and an exact quote from the posting as evidence, a concrete fix, and a first-person rebuttal you can reuse in a cover letter or interview. So you don't just hear "no", you learn why, and how to argue back.

It runs as one GPT-5.6 structured call on your own API key, about four cents per review. It never fills anything, never submits anything, never changes the page. Autofill tools and mass-apply bots help you send more applications.

Red Team makes one application stronger.

How we built it - a team of two: me and Codex

Before any code, I wrote a build brief: the product spec, the API contracts, hard rules ("exactly these permissions, nothing more"), and six phases, each ending in a human verify gate.

Codex read the brief and built phase by phase, manifest and auth first, then page extraction, then the model call, then the UI. At every gate, Codex stopped and printed a checklist, and I verified it against real things: my real Showcify account, live job postings. Only then did we continue.

Codex wrote the extension code, the test fixtures, and the docs. I ran the gates, and said "no" a lot.

The habit that helped most: adversarial review. We pointed a fresh Codex session at the codebase with a strict reviewer prompt every finding needed a file and line, quoted code, and a concrete failure scenario. Those passes caught real bugs before they shipped: host permissions that had quietly widened to <all_urls>, a focus race that wiped results and could re-bill a review, an innerHTML sink parsing untrusted page data.

Challenges

  • Models paraphrase. Evidence can't. A review you can trust needs verbatim quotes, so the code checks every quote with exact substring matching against the resume and posting. If a quote doesn't match, it renders unhighlighted the model's claim is visibly weaker. GPT-5.6 judges; code verifies.
  • Auth without a login screen. The extension piggybacks the user's existing Showcify session by reading the session cookie through the extensions API - read-only, re-read fresh each time, never stored. No password ever touches the extension.
  • Every job site is different. Extraction falls back in layers: JSON-LD structured data, then known-site selectors, then a text heuristic - each tested on live pages at a gate, because selectors lie until verified.
  • Job pages are hostile input. Everything a page returns is validated, clamped, and treated as untrusted including the job text we send to the model.
  • Staying small on purpose. Vanilla JavaScript, zero dependencies, no build step, two network hosts, minimal permissions. Clone it, load it unpacked, and it runs.

What we learned

  • The spec is the program. The clearer the brief, the better Codex builds. Most of our bugs traced back to something the spec left vague.
  • Gates keep agents honest. "Stop and let a human verify" cost minutes and saved hours.
  • Model output is untrusted input — even your own model's. Validate it like you'd validate anything from the network.
  • Constraints made it better. No dependencies meant nothing to audit, no build step meant judges install it in minutes, and BYOK meant privacy came free.

What's next

Application answers that the extension learns only when you explicitly save them, filling forms but never submitting and a version of Red Team built into Showcify itself, so every job seeker gets rejected here first.

Built With

Share this project:

Updates