TrustLens AI

• 

  Dynamic multi-vector asset ingestor with real-time payload sanitization and background asynchronous security scanning pipelines.

• 

  Secure Merchant Authentication gateway featuring timing-safe credential verification and cross-origin access controls.

• 

  Multi-tenant merchant onboarding system backed by PostgreSQL security schemas and dynamic API token generation.

• 

  Deep-dive cyber forensics rendering the live Trust Score, evidence-grounded AI vulnerability breakdown, and timestamped freshness tracking.

• 

  Unified security control plane showcasing real-time composite trust scores across Domains, IPs, and active EVM wallets.

Inspiration

E-commerce conversion is dying because new buyers don't trust unknown domains or unverified crypto-wallets at checkout. We saw merchants losing billions to "Trust Friction," and we realized that static, expired PNG badges are no longer enough to keep users safe. We wanted to build a dynamic, cryptographic trust signal that lives at the exact moment of transaction.

What it does

TrustLens AI is a real-time, multi-vector trust engine for Web2 & Web3 commerce. It scores Domains, IPs, and EVM Wallets in real-time across 6+ independent OSINT/Blockchain APIs. It generates a live "Trust Score" and a "Confidence Factor," providing merchants and users with actionable, evidence-backed security intelligence.

How we built it

We architected TrustLens AI for production, not just a hackathon demo:

• Core Engine: Deployed on Supabase Edge Functions with a hybrid scoring logic blending traditional TLS/DNS health with Etherscan-based blockchain forensics.
• The Scoring Algorithm: To calculate the final composite trust score ($T_s$), we use a weighted deterministic model combined with a decaying confidence factor ($C_f$) based on telemetry freshness:

$$T_s = \left( w_1 \cdot \text{Domain}{\text{score}} + w_2 \cdot \text{IP}{\text{score}} + w_3 \cdot \text{Wallet}_{\text{score}} \right) \times C_f$$

• AI Analyst: We integrated Baidu's ERNIE as an automated security engineer, turning raw telemetry into precise, evidence-grounded security fixes.
• Reliability: We bypassed gateway header-stripping using a proprietary Shadow DOM injection method, ensuring 100% reliable widget rendering on any third-party checkout.
• Resilience: Implemented EdgeRuntime.waitUntil() for non-blocking parallel processing, Stale-while-revalidate edge caching to handle 10,000+ RPS, and SSRF guards at the database level.

Challenges we ran into

The biggest hurdle was the browser's aggressive cross-origin security policies stripping our Content-Type headers. We overcame this by pivoting to a Shadow DOM injection pattern, which allowed us to bypass gateway limitations and ensure our widget renders perfectly every time, regardless of the host environment.

Accomplishments that we're proud of

• Production-Grade Audit: We passed a Phase 2 Red Team security audit on our own infrastructure, hardening the engine against SSRF and TOCTOU race conditions.
• Hybrid Security: Successfully unified Web2 domain reputation and Web3 wallet forensics into a single, cohesive trust signal.
• Render Reliability: Developed a robust, non-blocking widget injection system that works on any external checkout page.

What we learned

We learned that in modern web security, infrastructure resilience is just as important as the AI model itself. We deepened our understanding of Edge runtime constraints, cache-busting, and the necessity of defense-in-depth strategies like http-equiv fallbacks and binary response payloads.

What's next for TrustLens AI

We plan to expand our forensics to include multi-chain support (Solana, L2s), develop a "Trust API" for mobile wallets, and integrate automated smart contract scanning for DApps.

Built With

• abuseipdb
• baidu-ernie
• deno
• etherscan-api
• google-cloud-ai-(gemini/vertex)
• react
• shadowdom
• supabase
• typescript
• virustotal