ScamShield AI — Now Evolving into Aegisflow

• 

  Homepage

• 

  Analyzer

• 

  How ScamShield work

• 

  Scam Shield Features

• 

• 

Inspiration

Every day, people receive suspicious SMS messages, emails, social media messages, payment requests, and other communications that may be designed to steal money, personal information, or account credentials. These messages often create urgency, impersonate trusted organizations, promise unrealistic rewards, or pressure recipients into acting before they have time to verify the facts.

Unfortunately, suspicious communications can look convincing, and many people do not know which warning signs to look for or what to do next.

We built AegisFlowX — Think Before You Trust to help people pause, examine suspicious communications, understand potential risks, and make more informed decisions before responding.

Our goal is to make practical digital-safety guidance more understandable and accessible, especially for people who may not have cybersecurity expertise.

What it does

AegisFlowX is an AI-powered scam and threat analysis prototype. Users can submit suspicious text, such as an SMS, email, social media message, or payment request, for analysis.

The application is designed to help users:

• Analyze suspicious messages: Examine submitted text for potential scam indicators and other warning signs.
• Understand the evidence: Receive plain-language explanations of suspicious wording, urgency tactics, impersonation attempts, and other potential red flags.
• Assess potential risk: View a structured assessment that communicates the estimated severity and uncertainty of the analysis.
• Identify useful indicators: Extract relevant indicators of compromise when they can be identified from the submitted content.
• Receive recommended next steps: Get practical safety guidance, including independent verification and precautions to take before sending money, clicking links, or sharing sensitive information.
• Access an evolving security workspace: The application includes a broader dashboard and investigation-oriented interface, with authenticated user access and a developing investigation-history experience.

Rather than presenting an AI-generated verdict as unquestionable truth, AegisFlowX aims to explain why a message may be suspicious and help users decide how to verify it safely.

How we built it

AegisFlowX is built with Next.js and TypeScript, providing the foundation for its user interface and server-side application logic.

Its AI analysis pipeline integrates a hosted language model through the Featherless AI API. The application uses the Qwen3-VL model endpoint to generate structured analysis from submitted text.

The implementation combines several layers:

• Input validation: Checks incoming submissions before analysis.
• AI-assisted analysis: Examines the content and produces an explanation of potential threats.
• Structured results: Organizes findings into fields that the interface can present consistently.
• Warning-sign checks: Uses deterministic checks alongside AI analysis to help identify relevant patterns.
• Response validation: Validates the structure of model responses before presenting the results.
• User authentication and database integration: Uses Supabase Auth and PostgreSQL-backed storage to support authenticated accounts and the development of private investigation history.
• Deployment workflow: Uses GitHub for source control and Vercel for deployment.

Security and reliability are important design considerations. Submitted messages are treated as untrusted content, suspicious links are not automatically opened, and AI-generated results are intended to be interpreted as guidance rather than definitive proof of fraud.

Challenges we ran into

One of the main challenges was designing an analysis experience that is useful without overstating what AI can determine.

A legitimate message can contain unusual wording, while a carefully constructed scam can appear professional and convincing. AI models can also miss indicators, produce inaccurate explanations, or express more confidence than the available evidence warrants.

We therefore focused on presenting understandable explanations, highlighting potential warning signs, communicating uncertainty, and recommending independent verification.

Another challenge was integrating authentication, database permissions, and deployment configuration into a working application. Connecting these components requires more than a successful build: user sessions, database access rules, and deployed behavior must also be verified.

These challenges reinforced the importance of testing the complete user experience, protecting user data, and being transparent about the limitations of automated analysis.

Accomplishments that we're proud of

We developed a working foundation for an accessible, AI-assisted scam-analysis experience that focuses on more than a simple suspicious-or-safe label.

We are proud of the application's emphasis on understandable evidence, structured findings, practical next steps, and responsible communication of uncertainty.

We also established the foundation for authenticated user accounts and a broader investigation workspace, creating a path toward a more complete personal cybersecurity assistant.

Most importantly, the project is designed around a practical question: after encountering a suspicious message, what should someone examine, what should they avoid doing, and how can they verify the situation more safely?

What we learned

Building AegisFlowX taught us that useful AI security tools need more than a capable model. They also require validation, careful interface design, secure data handling, and a clear explanation of the limitations of automated judgments.

We learned the importance of treating user-submitted content as untrusted input, validating structured model output, distinguishing a potential warning sign from confirmed malicious activity, and testing authentication and database permissions independently.

We also learned that a good security experience should help users understand their options rather than create unnecessary fear or encourage them to trust an AI verdict blindly.

What's next for AegisFlowX

Our vision is to evolve AegisFlowX into a more comprehensive cybersecurity assistant.

Planned improvements include:

• Document and screenshot analysis: Allow users to upload screenshots, PDFs, and supported documents containing suspicious messages, invoices, payment requests, emails, or other material they want examined.
• Image text extraction: Use OCR and appropriate document-processing tools to extract readable content from images and scanned documents before analyzing it.
• Evidence-based recommendations: Combine extracted text, contextual warning signs, and relevant indicators to provide clearer explanations and safer next steps.
• Private investigation history: Save and revisit previous analyses, with access restricted to the authenticated user who owns each record.
• Threat intelligence integrations: Explore reputable threat-intelligence sources to help check domains, URLs, and other indicators where supported.
• Smarter notifications and reminders: Notify users about relevant security actions, investigation updates, and useful safety guidance without overwhelming them.
• Learning resources: Add practical cybersecurity lessons, examples, and guidance to help users recognize common fraud techniques.
• Reporting guidance: Provide relevant instructions for reporting suspected scams to appropriate platforms, financial institutions, or official channels.
• Privacy and security improvements: Introduce appropriate file-size limits, upload validation, retention controls, access protections, and clear explanations of how submitted content is handled.

Our long-term objective is to make cybersecurity guidance easier to access and act upon, while keeping user privacy, transparent reasoning, and responsible AI use at the center of the experience.

AegisFlowX is an evolving prototype. Its assessments are not definitive proof of fraud and do not replace professional security services, financial institutions, or official reporting channels.

Built With

• api
• css
• featherless
• n8n
• next.js
• openai
• openclaw
• sdk
• supabase
• tailwind
• typescript
• zod