Tampered letter
Legitimate Offer Letter
A email from a non-verified source
The extension

Inspiration

It started with an email. One of us got invited to do an "online assessment" for a role we'd applied to. The task turned out to be solving an actual problem for their product, not a generic coding exercise. The domain sending it wasn't the company's real domain. No compensation mentioned, no real recruiter name, just a rushed deadline and a link.

We talked about it at our table, and it turned out we weren't the only ones. A few other teams near us had similar stories, fake recruiters, lookalike domains, offers that felt too easy, assessments that looked like free labor for a company that might not even be real. Almost nobody had a way to check if any of it was real before responding.

That's what we built.

What it does

Vouch checks the things a job scam relies on being unverifiable. Paste a recruiter's email and get back whether the domain is real, how old it is, and whether it looks like a typosquat of a real company's domain. Upload an offer letter PDF and we check its signature and hash against what the company actually issued, so an edited or forwarded PDF gets caught. Paste an assessment or message and we scan it for known scam patterns, payment requests, gift cards, urgency language, requests for sensitive info before any real offer exists.

On the company side, an employer registers their domain, adds their real recruiters, and issues offers that get signed and QR-stamped, so a candidate doesn't have to take a document's word for itself. Every check comes back as verified, scam, or unverifiable. We don't guess when we don't have evidence.

How we built it

FastAPI backend in Python. Domain checks use RDAP for registration age, DNS TXT records to prove domain ownership, and fuzzy matching to catch lookalike domains. Email authenticity reads the Authentication-Results header mail providers already attach, rather than reimplementing SPF/DKIM/DMARC ourselves.

Signed offers use Ed25519 keypairs, the private key signs an offer's payload, the public key lets anyone check the signature independently. We stamp each offer PDF with a QR code and verification footer, and hash the final file so any edit after issuance breaks the match.

Scam-pattern detection runs on regex rules pulled from real FTC alerts and scam reports. All of it feeds into one decision function that returns a verdict and a plain-English reason.

The frontend is a web app plus a browser extension, so a candidate can check something right where they're already reading the message.

Challenges we ran into

Getting the three-way verdict right took real thought. It would've been easy to build a binary safe/unsafe flag, but that's dishonest when we just have no record of a company either way. We had to keep "checked and it's fake" and "no information" from collapsing into the same answer.

Wiring the frontend to a real backend mid-hackathon had its own friction, environment setup, matching folder structures so imports actually resolved, and adjusting when we built for an endpoint that turned out not to exist yet.

What we learned

How much of trust in hiring already runs on patterns other industries take for granted, TLS certificates, DKIM, Stripe-style webhook signing, and how little of that exists yet for hiring itself. And just from talking to people at our table, how common this already is.

What's next

Real-time domain monitoring, so companies get alerted the moment a lookalike domain registers. Deeper ATS integration, so signing an offer is part of a recruiter's normal workflow. And expanding the extension so verification happens automatically while reading, not just when someone thinks to go check.