Does This Belong Here? I Built a Phishing Checker for the People I Love

Tasha · DataSec Chronicles — Sat, 03 Oct 2026 16:04:20 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

"Does This Belong Here?" — a friendly phishing checker for the people in my life who still get spam.

I built it for my mom and my husband. They both know the basic rule — don't click suspicious links — but nobody ever explained the why, and the why is the part that actually protects you in the moment. When a real scam email lands, dressed up to look urgent and official, the rule evaporates, and the panic takes over.

This tool closes that gap.

You paste in an email or text that feels off, and it walks you through it the way a security analyst would — in plain English, no jargon. It gives a one-line verdict, a short list of the red flags it spotted and why each one matters (the threat behind it), and one calm next step.

Every answer ends with the question that keeps you safe:

"Does this belong here?"

It's not trying to make anyone a security expert. It's trying to hand them the instinct — the same "does this belong here?" question a SOC analyst asks on every alert, pointed at their own inbox.

I handed it to my husband. Here's what happened.

This is the part I care about most, because the challenge is Build for a Friend — so I actually gave it to one.

I set it up and let my husband loose on it with a real email. He copied a whole message, pasted it into the box... and then tried to click the box, expecting something to happen.

I had to point him to the "Check it for me" button.

Noted. 😂

It was a real, humbling piece of UX feedback. Building for non-technical people means watching exactly where they get stuck, and he found my blind spot in about ten seconds.

Then the "Thinking like an analyst..." screen came up, and when the verdict appeared, he was genuinely a little surprised it had actually read and understood the email.

He went through the breakdown, agreed with every red flag it found... and said:

"Good job."

That was the whole goal in one sentence.

Not "wow, impressive AI" — just a regular person reading a plain-English explanation of a suspicious email and trusting it enough to agree.

That's the tool working.

Demo

Try it live: 👉 labs.datasecchronicles.com/tools/does-this-belong-here

The app itself runs in your browser — there's no DataSec Labs backend, and I don't store your message or API key.

To use the live version, you'll need a free Google AI Studio API key. Your message is sent directly from your browser to Google's Gemma API for analysis.

Because Gemma is open-weight, this same concept can also evolve into a fully local version where analysis happens on your own machine instead of sending the message to a cloud API.

Code

Tash925 / does-this-belong-here

A friendly phishing checker built with Gemma (open-weight AI) — plain-language scam detection for non-technical people. #Hacktoberfest

🛡️ Does This Belong Here?

A friendly phishing checker for the people in your life who still get spam.

Paste in an email or text that feels off, and it walks you through it the way a security analyst would — in plain English, no jargon. One-line verdict, the red flags it spotted and why each one matters, and one calm next step. Every answer ends with the question that keeps you safe: "Does this belong here?"

Built with Gemma, Google's open-weight model, for the Hacktoberfest 2026 "Build for a Friend" Weekend Challenge.

Part of DataSec Chronicles — storm to SOC, finding what doesn't belong.

Why I built it

My mom knows not to click the link. My husband does too. Most people have picked up the don'ts — but nobody ever explained the why, and the why is the part that actually protects you when…

View on GitHub

It's a single self-contained HTML file — one page, no build step, no backend. The whole thing is HTML, CSS, and a little JavaScript, deliberately low-code so the idea and the writing carry it.

How I Built It

The core is Gemma, Google's open-weight model, doing the actual analysis.

The app:

Takes the suspicious message the user pastes in.
Sends it to Gemma with a carefully written system prompt that tells it to act as a warm, plain-spoken helper for a non-technical person — give a verdict, name the red flags with the reason each one matters, and never shame the person for asking.
Returns a clean, structured answer anyone can act on.

The interesting engineering wasn't the plumbing — it was the prompt.

Getting an open model to explain phishing the way a kind, patient expert would took real iteration, especially getting it to stop showing its reasoning scratch work and just hand over the finished answer.

I also made the app query which models my key can actually use and automatically pick an available Gemma, so it doesn't break when model names change out from under it — which they did, mid-build.

Why Does Open Innovation Matter?

Because of whose data this is.

The whole point of this tool is to check a real email — which often contains personal details, names, account references, and private information.

The live version currently sends that message directly from the user's browser to Google's Gemma API for analysis. DataSec Labs doesn't receive or store it.

But building around an open-weight model creates another possibility: local-first analysis.

The same idea could run with Gemma entirely on the user's own computer through something like Ollama. In that version, the suspicious email wouldn't need to leave the person's machine at all.

That's especially important for a tool designed for people who may already be vulnerable to scams.

Open innovation gives developers the option to move beyond "paste your private information into someone else's cloud" and build tools where users can retain much more control over their own data.

For a small, personal safety tool like this, that isn't just an interesting technical option.

It's part of what makes open models worth building with.

Prize Categories

Best Use of Gemma — Gemma (Google's open-weight model) is the engine doing all the phishing analysis.

I'd Love Your Feedback

I built this because knowing the rule "don't click suspicious links" and recognizing why something is suspicious in the moment are two different things.

If you try Does This Belong Here?, I'd love to hear what you think — especially if there's something that could make it easier for a non-technical person to use.

And if you have questions about the build, Gemma, or what I learned testing it with my husband, leave them in the comments. 💜

Built as part of DataSec Chronicles — storm to SOC, finding what doesn't belong. 💜

DEV Community: Tasha · DataSec Chronicles