SafeScroll

Inspiration

Modern social engineering fake bank locks, OTP urgency traps, prize scams, and impersonation schemes has evolved beyond obvious grammar errors. Everyday web users and elderly relatives are targeted constantly with convincing threats and deceptive UI patterns. Traditional cybersecurity tools either drown users in cryptic jargon, score mechanisms without rationale, or harvest personal data by routing private communications through third-party cloud servers. We built SafeScroll to provide a calm, explainable "second thought" that keeps user data strictly on-device while breaking down risks in plain language.

What it does

SafeScroll intercepts risky links, screenshots, and text messages before a user falls victim to a trap:

ZERO Mode (Privacy-First): Evaluates content, heuristics, and OCR locally. Raw messages and personal data never leave the user's device.

Explainable AI (XAI): Instead of an opaque risk score, SafeScroll highlights exact evidence weights such as urgency triggers, unencrypted HTTP transport, or OTP collection flags and explains the rationale in plain language.

On-Device OCR: Uses Tesseract.js directly inside the client to extract text from screenshots, SMS alerts, and payment receipts without cloud uploads.

Senior & Accessibility Support: Built-in Text-to-Speech (TTS) narrations read threat breakdowns aloud, helping seniors and visually impaired users stay informed.

Dual Protection Layers: Operates as both a live web scanner and a Chrome Manifest V3 browser extension providing contextual alerts.

Cryptographic Rule Verification: All scam pattern rulesets are verified using Ed25519 signatures to prevent rule tampering or rogue injection.

How we built it

Client & UI: Built with Next.js 15 (App Router), React 19, and Tailwind CSS 4, delivering an accessible dashboard and interactive scanner.

Browser Extension: A Chrome Manifest V3 extension compiled with Vite and TypeScript, integrating on-device Tesseract.js for client-side OCR and the Web Speech API for vocal narration.

Machine Learning & Intelligence: Combines client-side character-level heuristic models with an optional local LLM engine powered by Ollama (qwen3:1.7b) for privacy-preserving deep conversational threat triage.

Backend API & Data Engine: A high-concurrency FastAPI (Python 3.12) service paired with SQLAlchemy 2.0 Async, PostgreSQL 16, and a Redis sliding-window rate-limiting layer.

Security & Reliability: Password verification powered by Argon2, signature validation via Ed25519, and complete end-to-end coverage using Playwright, Vitest, and Pytest.

Challenges we ran into

On-Device Performance vs. Accuracy: Running OCR and heuristic classification entirely in-browser without freezing the UI thread required careful asset preloading, Web Worker offloading, and lightweight token hashing.

Explainability Without Jargon: Translating multidimensional detection features into concise, non-alarmist guidance required iterative prompt engineering and structured rule-weight mappings.

Manifest V3 Sandbox Constraints: Navigating MV3 restrictions around remote code execution and large bundle constraints required bundling our detection heuristics into an independent, signed TypeScript package (@safescroll/detection-core).

Accomplishments that we're proud of

Achieving 100% test coverage across our monorepo unit, security, and Playwright E2E suites.

Achieving near-instant client-side OCR and heuristic scanning with zero server dependency in ZERO Mode.

Designing a non-punitive, calm UI that reduces user anxiety rather than inducing panic.

What we learned

Local-first ML inference with lightweight open models can match or outperform centralized cloud APIs for domain-specific safety tasks while offering total privacy.

Explainability (showing the "why" behind a detection) builds significantly more user confidence than raw numerical security scores.