SafeSignal — A Second Opinion Before You Click

Inspiration

Scams often succeed in the seconds before someone clicks. SafeSignal creates a calm moment to understand suspicious text, not a scary technical verdict.

What it does

SafeSignal is a privacy-first message companion for people receiving potentially fraudulent texts, emails and DMs. Paste text (after removing personal information) or try one of three synthetic scenarios. A deterministic engine identifies urgency, requests for passwords or one-time codes, unusual payments, secrecy, deceptive domain structures, shorteners, IP addresses, and named-brand/link mismatch. It explains every matched sign in plain language and displays URL hosts as inert text. Users can copy general guidance without copying the original message.

How we built it

Made with native HTML, modern CSS, vanilla JavaScript, SVG and Progressive Web App service-worker support. All classification runs in browser memory: no backend, no cloud API, no analytics, cookies, account or messages saved. An offline standalone HTML edition works directly from a downloaded file, and the hosted PWA caches the interface after a first visit.

Challenges

We focused on trustworthy safety UX. Warning levels are not a diagnosis. Messages are rendered as text, links are never clickable, and the copy-guidance feature excludes original pasted data.

Accomplishments

A responsive checker, three fictional practice scenarios, six-step safety checklist, privacy explainer, automated Node.js engine tests, and desktop/mobile Chromium interaction tests.

What we learned

Trustworthy safety tools need transparent uncertainty more than a false numeric confidence score. People benefit from clear context and independent verification.

Example safer outcome

A fictional delivery text pressures the user to follow a tracking link within 24 hours. SafeSignal highlights time pressure and recommends opening the legitimate courier app independently rather than following the sender's link.

Known limitations

Educational heuristic analysis only. It can miss novel attacks or falsely flag legitimate messages. A low-warning result never proves safety. No live link reputation, actual sender verification, redirect resolution, attachment scanning or emergency response.

Built during hackathon and credits

All application-specific design, implementation, tests, copy, screenshots and documentation created on October 29, 2026 within the October 17–November 22 build window. Original synthetic examples on .example domains; no preexisting app components, scraped datasets or third-party runtime libraries. AI assistance: ChatGPT (OpenAI) supported concept, code and test creation. Source licensed MIT.

Setup

Open the hosted web app, choose a fictional sample and select "Check message." Explore explanations and the checklist. Or download the source package and double-click standalone.html for a fully local offline demo. No account, token or installation required.

Built With

• chatgpt
• css
• html
• javascript
• node.js
• playwright
• progressive-web-app
• service-worker