Message, Unpacked.

Teaching kids that everything is a scam does not work. Message, Unpacked. builds judgment instead : 97 reviewed cases, each answered scam, safe, or not enough evidence yet. Open-source, bilingual.

Comment

Inspiration

I graduated with a background in education and now work as a cybersecurity engineer. Message, Unpacked. is where those two parts of my professional identity finally meet. I had wanted to contribute to open source for years but never found the right combination of time, purpose, and momentum. OpenAI Build Week gave me the occasion, and Taiwan gave me the subject.

Fraud is a serious problem here. Official government figures show that even after enforcement improved through 2025, reported losses still averaged over NT$215 million every day, which works out to more than US$2 billion a year in a country of 23 million people.

Taiwan already has official reporting hotlines and consultation services. What was missing was somewhere for students to practise judgment before they meet a real scam.

So I wanted to build something other than a warning list. Warnings train suspicion, and suspicion by itself tends to fail twice over. Students who apply it evenly end up treating every message as a scam, and students who find that exhausting stop listening altogether. What actually helps is judgment, which includes being able to tell that a message is fine, or that you cannot yet tell either way.

What it does

Message, Unpacked. is an open-source digital-literacy learning experience with 97 cases in two languages.

Students read realistic SMS messages, chats, and emails, then classify each one as fraudulent, trustworthy, or insufficient evidence.

That third option carries most of the weight. Answering "fraud" to everything should not get you a good score, so the library includes messages that are genuinely safe and messages nobody could call yet. Recognizing uncertainty, and verifying before acting, is the skill being practised.

After answering, students see a score, a breakdown of the evidence, safer next steps, and official help resources for their country. Cases adapted from documented events show their source, date, and reported impact.

Teachers pick a learning stage, topic, activity length, and case list, then choose a mode:

  1. Static activity links — a link or QR code with no account and no backend. Students practise on their own, or a teacher leads on a projector.
  2. Live classroom interaction — the teacher projects the full case while student phones show only the question number and choices. Answers sync through a short-lived room, and only the class totals are revealed.

The Traditional Chinese library holds 72 cases across six themes and five learning stages, split 44 fraudulent, 15 insufficient-evidence, and 13 trustworthy so that no single answer wins.

A 25-case English demonstration covers grades 10–12 with US situations and resources. I am calling it a demonstration until local educators review it, because scams are built out of local payment methods, local institutions, and local habits. Translating the words would not make it right.

How we built it

The whole core experience is static, so it runs on GitHub Pages with no backend at all. The frontend is Astro, TypeScript, React, and XState. Cases are written in YAML and validated by Zod schemas plus a set of editorial rules, which means a teacher can add a case without touching application code.

The optional live mode uses a Cloudflare Worker with one Durable Object per classroom. WebSocket Hibernation keeps idle rooms from consuming resources, and teacher credentials, one-time connection tickets, and automatic cleanup keep each room short-lived. Student devices never receive the full case text, the explanation, or the running tally. The backend stores no names, email addresses, rankings, or learning histories.

The risks in a project like this are editorial as much as technical, so CI checks the content the same way it checks the code: score bands, classifications, age coverage, sensitive-content flags, accessibility, and licensing.

I built it inside OpenAI Codex, using GPT-5.6 in two roles. sol handled ideation and architecture, including where to draw the line between the offline core and the optional live service. terra did the implementation, tests, documentation, localization checks, and code review.

I kept that split on purpose. Teaching principles, security boundaries, age appropriateness, and every decision to publish a case stayed with me. The models made the work faster and caught inconsistencies I would have missed, but they were never the ones deciding what a student should learn, or whether a source really supported a claim.

Source code is Apache-2.0. Original educational content is CC BY-SA 4.0.

Challenges we ran into

The hardest challenge was not implementing a quiz. It was deciding what the quiz should teach.

Early on, several cases punished students for being right. One offered "this is a scam" as an option, then attached a bad action to it, like publicly accusing a classmate, and docked points for the whole answer. A student who judged correctly lost marks for a behaviour I had bolted on. Options like that teach people to hunt for the answer shape rather than think, so I rewrote every one of them.

Scoring had a similar flaw. Giving away half a verification code scored higher in some cases than simply opening a suspicious link, which is exactly backwards. I ended up defining fixed score bands based on what an action actually gives away, then recalibrating the entire library against them.

Age appropriateness was its own problem. A scenario that works for a high schooler can frighten a seven-year-old. Messages involving secrecy, coercion, or instructions not to tell an adult needed content warnings and teacher guidance, and one of them I removed from the English set entirely rather than carry that language into classrooms whose norms I have not reviewed.

The architecture created a different tension. I wanted live classroom participation without making the learning experience depend on a server, which led to a complete backend-free core plus an optional room service. That service then needed careful boundaries of its own: classroom codes must not become teacher credentials, secrets must not appear in URLs, and hidden results must not leak to student phones.

Accomplishments that we're proud of

This is my first complete open-source education project, and the parts I am proudest of are the ones that took the longest to get right.

The library is calibrated. Scores follow fixed bands, so revealing part of a secret never outscores plain caution. Every topic includes trustworthy cases, so a student cannot pass by distrusting everything. Each documented case was reopened at its original source and checked line by line, which is how I found that a repository-wide text cleanup had quietly altered a quoted police headline.

Those decisions are written down and enforced. The editorial rules sit in CI next to the code checks, so a future contributor cannot drift away from them by accident, and neither can I.

I am equally glad about what the project never collects. There are no student accounts, no rankings, no behavioural profiles, and no permanent classroom histories. The point is to strengthen judgment, not to build another student-data system.

What we learned

Scam techniques change every year, so memorizing current templates has a short shelf life. What lasts is a process:

  1. work out what the message is asking you to do;
  2. separate what it claims from what it proves;
  3. watch for urgency, authority, secrecy, or unusual payment methods;
  4. check through a channel the sender does not control; and
  5. ask a trusted adult or an official service when it matters.

Building it static-first turned out to matter more than I expected. A school IT team can host this without a procurement review, and there is no server to keep running when I move on to something else.

Treating educational content as structured data was the other lesson. Schemas and automated rules cannot replace a qualified reviewer, but they hold review decisions in place, which is what makes community contributions safe to accept.

And AI helped most where I stayed responsible for the judgment. It was quick and tireless at the mechanical work. Culture, pedagogy, child safety, and whether a citation actually says what I claimed it says still needed a person.

What's next for Message, Unpacked.

The next step is classroom validation. I want teachers to watch how students explain their reasoning, and to tell me which cases are unclear, culturally off, or wrong for a particular age.

After that:

  • expand the library through moderated community contributions;
  • add more documented real-world cases;
  • finish manual VoiceOver and NVDA testing;
  • invite local educators to review and expand the English demonstration; and
  • support more languages through independently localized case libraries.

Message, Unpacked. will stay open source, static-first, and free of student accounts and long-term tracking.

The long-term goal is not to predict every future scam. It is to leave students with a habit that still works after the scam changes: stop, unpack the message, check the evidence, and ask for help when you need it.

Built With

Share this project:

Updates