Built TrailQR Raksha that forces people to go out and check QR before paying

Soumyabrata Mukherjee — Fri, 09 Oct 2026 21:27:17 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

Almost the entire India runs on QR codes. From small shops to big ones, all have got one, attached somewhere or other. But just scanning the QR code was never enough. For example: A 2D QR matrix is human-unreadable. Unlike a hyperlink, victims cannot inspect the payee address, domain, or pre-filled transaction amounts before acting. Me and my friends built something useful.

We created TrailQR Raksha that is a privacy-first, offline-capable QR security guard built for street environments across West Bengal. Deterministic rules decide. Google Gemma 4 explains in English and vernacular Bengali. Zero sensitive data leaves your phone unsanitised. And Snowflake CoCo aggregates neighborhood threat patterns.

Point your phone at a QR code and it checks it for you:

Simple rules decide whether a QR looks safe or suspicious.
Google Gemma 4 explains why, in English and in Bengali.
Your private details stay on your phone. Anything sensitive is cleaned before it goes anywhere.
Snowflake CoCo spots scam patterns across neighbourhoods.

And since a QR code only exists out in the real world, you have to go outside, find one and scan it. No sitting in your room with this one :))

Demo

Honestly, you're lucky my friends deployed this. Left to me, I'd have told you to deploy it yourself. I'm a DIVA, after all. 💅

Just kidding! It's live here: qr-raksha.vercel.app. Try it yourself instead of taking our word for it.

Code

debangshuuii / QR-RAKSHA

TrailQR Raksha — Check a QR Before You Pay

Kolkata — and India — runs on QR codes. Tea stalls, taxis, parking, donations, ticket counters: you scan, you pay, you move on. One sticker pasted over a shop's real QR and your payment goes to a scammer, or a "KYC verify" QR takes you to a credential phishing site. You cannot see where a QR goes until it is too late.

TrailQR Raksha is a privacy-first, offline-capable QR security guard built for street environments across West Bengal.

📑 Table of Contents

📚 Judging & Hackathon Documentation

🎯 Live Judging Playbook: 3-minute pitch, live demo steps, and track defense answers.
📝 Official Submission Form: Ready-to-submit form with all 10…

View on GitHub

How I Built It

Frontend: plain HTML, CSS and JavaScript, no frameworks
Safety checks: simple rules that run on your device (js/rules.js)
AI: Google Gemma 4, through the Gemini API, with an offline Ollama backup
Data: Snowflake and Snowflake CoCo
Agent skill: published as an open-standard Agent Skill (skills/qr-audit/SKILL.md)

You can add the skill to your own agent with one command:

npx skills add https://github.com/debangshuuii/QR-RAKSHA/tree/main/skills/qr-audit

Why Does Open Innovation Matter?

Okay, DIVA hat off for a minute. 😌

QR Raksha is made for someone standing at a stall in a lane with bad network, not someone sitting on fast Wi-Fi in a café. Open models made that possible:

It works offline. Gemma 4 is open, so we could run it locally with Ollama. If the network drops, the guard stays on.
Your data stays yours. We control exactly what leaves the phone, instead of just trusting someone else's server.
It speaks Bengali. A warning nobody can read is useless. Plain Bengali explanations make it useful for shopkeepers, not just developers.

The rules are open too. Anyone can read them, question them and add new scam patterns. For a security tool, "read the code" beats "trust us".

One more thing: the AI never decides if a QR is safe. The rules do. Gemma only explains. We didn't want a chatbot confidently saying "looks fine!" about a scam.

Prize Categories

Best Use of Gemma: Gemma 4 explains every scan in English and Bengali. It runs through the Gemini API, with an offline Ollama backup so it still works when the network doesn't.
Snowflake: CoCo for neighbourhood scam patterns, plus a published Agent Skill

Team

Built with my friends, who actually believe in deploying things:

Now go touch some grass, and scan responsibly.

Built an AI Review Agent for my DevFriend Like CodeRabbit

Soumyabrata Mukherjee — Mon, 05 Oct 2026 05:52:23 +0000

This is a submission for the [Hacktoberfest Weekend Challenge: Build for a Friend]. Lets see how Kiro IDE was used to streamline the entire thing. (https://dev.to/challenges/hacktoberfest-weekend-2026-10-01)

P.S: Written by one's own experience

What I Built

Honestly, let me give you a backstory. I love building stuff. I love practicing building in public. When I was there coding with my other friends who are also fellow developers, I saw that we had a hard time fixing all the issues that included only screenshots and nothing else. We didn't know what was root cause triggering that and how such could be prevented in long run. So I immediately thought of a plan: adding CodeRabbit and all. However it didn't solve the problem.

Neither for me neither for them. The developers had to know how to write a PR, then coderabbit reviews it. For most of cases, developers didn't care. They simply ran the software, found a bug and hitted on its issues. Its not that the bug is from their side, but it can come from the overall code too. They didn't know where exactly to pinpoint.

Naturally maintaining college and OSS is a hard stuff. My friends can't look at screenshots from every issue and debug whether its a local or a global issue. We needed an AI agent that could tell us where exactly it went wrong.

That why on Kiro Challenge and MLH x Kalyani Hackathon, I built PatchBridge. Its remarkably easy to use. Comment /patchbridge under an issue, Gemma 4 is multimodal anyways - understands the image, starts a session, streamlines its thoughts, calls GITHUB MCP tools for reading and grepping the repository thoroughly, comes with a solution and then raises a PR. After that other AI review agents like CodeRabbit and greptile can start working on it.

Demo

I didn't deploy it somewhere, honestly because I want people to learn how to self-deploy. I don't want them to just see repository and click "Yeah here's link, let me get it!". I want them to participate and understand no one is holding their hands by giving them a readymade solution.
Here's code however: https://github.com/Soumyabrataop/PatchBridge

Code

https://github.com/Soumyabrataop/PatchBridge

How I Built It

Don't get me wrong but I coded this using both my personal understanding and using Kiro.

I never thought I could complete this just alone. Hence, I decided to start this with Antigravity. However it isn't like "Code this for me. Here's the plan" but like "Look at this particular screenshot. It comes from this particular styling issue. Please create a patch that can fix the issue." - More engagement and understanding, not just driving on autopilot. Antigravity barely did anything.

I used a much better IDE named as Kiro, from Amazon after learning about it. It comes with specs, hooks and much more.

Why Does Open Innovation Matter?

A closed API is like a closed room. Dark and mysterious, we don't know what's going inside. Even reports published is a half story - we never know what's inside them. Open Innovation always stood out whether its Open Hermes, or Open Devin or a Open Copilot. Not just developers building products that are open-source versions of the existing solutions but something's that the existing solutions can take inspiration from! Hey don't think only the big inspires the small, the small does it too.

Adios,
Soumyabrata Mukherjee

DEV Community: Soumyabrata Mukherjee

Built TrailQR Raksha that forces people to go out and check QR before paying

What I Built

Demo

Code

debangshuuii / QR-RAKSHA

TrailQR Raksha — Check a QR Before You Pay

📑 Table of Contents

📚 Judging & Hackathon Documentation

How I Built It

Why Does Open Innovation Matter?

Prize Categories

Team

Built an AI Review Agent for my DevFriend Like CodeRabbit

What I Built

Demo

Code

How I Built It

Why Does Open Innovation Matter?