DEV Community

Tanishq Wankhede
Tanishq Wankhede

Posted on

ScopeShield AI: Privacy-Preserving Contract Risk Auditor & Scope Creep Shield for Freelancers (Powered by Google Gemma 2)

#devchallenge #hf26challenge #gemma #ai

Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle Submission 💸

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Every freelancer and solo agency owner knows the dread of Scope Creep and Predatory Client Contracts:

  • "While you're in there, could you also just build this other feature?"
  • "We won't sign off on milestone 2 until the design 'feels right' (14 revision rounds later)."
  • "Section 4: Payment terms are Net-90, with a 20% retainage holdback for 90 days."
  • "Section 5: Client owns all IP upon conception, regardless of whether payment has cleared."

According to freelance surveys, over 68% of freelancers lose 4 to 8 billable hours every week to unbilled scope creep, delayed payments, and ambiguous project boundaries. A single bad clause can easily cost an independent specialist $2,500 to $10,000+ in uncompensated labor.

Yet hiring an attorney costs $350 to $600/hour, putting formal contract review out of reach for routine project proposals.

Who Would Pay For It?

Freelancers, solopreneurs, digital design/dev agencies, and independent consultants.
At $29/month, catching just one unbilled revision round or preventing a single Net-90 delayed payout delivers an instant 6,000%+ ROI.

The Solution: ScopeShield AI

I built ScopeShield AI, a 100% local-first, privacy-preserving contract risk auditor and scope creep defense engine powered by Google's open-weight Gemma 2 model.

                  ┌───────────────────────────────────────────────┐
                  │               🛡️ ScopeShield AI               │
                  │   Local Freelance Contract & Scope Creep Guard │
                  └───────────────────────┬───────────────────────┘
                                          │
        ┌─────────────────────────────────┼─────────────────────────────────┐
        ▼                                 ▼                                 ▼
┌──────────────────┐            ┌───────────────────┐             ┌──────────────────┐
│  6-Pillar Risk   │            │   Bulletproof SOW │             │  Assertive Client│
│  Contract Audit  │            │  & Proposal Maker │             │ Pushback Drafter │
│  (0-100 Score)   │            │  (Exhibit A & B)  │             │  (Change Orders) │
└──────────────────┘            └───────────────────┘             └──────────────────┘
Enter fullscreen mode Exit fullscreen mode

ScopeShield AI audits client agreements across 6 critical freelance risk vectors:

  1. Scope Ambiguity: Detects loose phrases ("as needed", "whatever graphics", informal Slack iteration) and forces concrete boundary definitions.
  2. Revision Limits & Caps: Strikes predatory "unlimited revisions until client satisfaction" and replaces them with an enforceable 2-round cap + $110/hr Change Order clause.
  3. Payment Terms & Retainage: Flags Net-60/90 terms, unfair retainage holdbacks, and missing upfront deposits (mandating a 50% deposit before kickoff).
  4. Intellectual Property Protection: Enforces that IP ownership passes to the client strictly upon receipt of full, cleared payment.
  5. Termination & Kill Fees: Secures non-refundable deposits and prorated milestone pay upon project cancellation.
  6. Liability Caps & Non-Competes: Strikes broad indemnification exposure and anti-freelance non-compete clauses.

Demo

ScopeShield AI features a slick, dark-mode dashboard with real-time risk gauges, financial exposure forecasts, and interactive tools:

Key Capabilities:

  • 1-Click Preset Audits: Test real-world contracts immediately (Predatory MSA, Vague Brief Trap, or Protected SOW).
  • Interactive Risk Breakdown: Dynamic visual scores for all 6 pillars with color-coded severity badges (Critical Trap, Warning, Caution).
  • 1-Click Shield Clause Inserter: Copy pre-drafted legal counter-clauses with one click to paste straight into your client negotiations.
  • SOW & Proposal Generator: Input client notes and generate an airtight, production-grade Statement of Work with milestone payment schedules (50% upfront, 25% demo, 25% final).
  • Assertive Client Pushback Drafter: Auto-generates diplomatic yet firm emails for sticky situations (handling mid-sprint scope creep, demanding deposits, pushing back on Net-90).
  • Scope Creep ROI Calculator: Interactive sliders calculate your annual unbilled losses and project your net savings. 
flowchart TD
    subgraph LocalClient["💻 Freelancer Local Device"]
        UI["🖥️ Modern ScopeShield UI (Tailwind & Vanilla SPA)"]
        LocalStorage["🗄️ Local IndexedDB & Cache"]
    end

    subgraph CoreEngine["⚡ Local Node.js Express Runtime"]
        API["📡 REST Endpoints (/api/audit, /api/sow, /api/email)"]
        Auditor["⚖️ 6-Pillar Risk Scoring Engine"]
        SOWGen["📝 SOW Proposal Generator"]
        EmailGen["✉️ Pushback Drafter"]
        Heuristics["🛡️ Deterministic Rules Matrix"]
    end

    subgraph OpenWeights["🧠 Open-Weight AI Core"]
        GemmaAdapter["🔌 Gemma 2 Turn Formatter"]
        OllamaLocal["🦙 Local Gemma 2 Model (gemma2:2b / 9b)"]
    end

    UI -->|Submit Contract / Scope| API
    API --> Auditor
    API --> SOWGen
    API --> EmailGen
    Auditor --> Heuristics
    Auditor --> GemmaAdapter
    GemmaAdapter -->|Offline Local Inference| OllamaLocal
    OllamaLocal -->|Reasoning & Extraction| GemmaAdapter
    GemmaAdapter --> Auditor
    Auditor -->|Risk Score, Flags & Counter-Clauses| UI
    UI <--> LocalStorage

Code

The complete source code is open source under the MIT License:

🔗 GitHub Repository: https://github.com/tanishq4220/scopeshield-ai

Tech Stack:

  • Model: Google Gemma 2 (gemma2:2b / gemma2:9b) open-weight LLM
  • Backend: Node.js v24, Express, Native Fetch, Zero external runtime bloat
  • Frontend: Responsive Single-Page Application, Tailwind CSS, Lucide icons
  • Testing: Built-in Node test runner (node:test, node:assert) with 100% passing tests

Running the Test Suite: 

npm test
Enter fullscreen mode Exit fullscreen mode 
✔ Contract Auditor detects predatory clauses in MSA preset (2.47ms)
✔ Contract Auditor scores balanced protected SOW as safe (0.37ms)
✔ SOW Generator creates structured milestones and deposit schedule (29.1ms)
✔ Negotiation Email Drafter formats polite and firm pushback (0.34ms)
ℹ tests 4, pass 4, fail 0
Enter fullscreen mode Exit fullscreen mode

How I Built It

ScopeShield AI is engineered around a dual-engine architecture specifically optimized for Google's open-weight Gemma 2:

1. Gemma 2 Turn Formatting & Prompt Engineering

Gemma 2's instruction hierarchy relies on explicit turn tokens: <start_of_turn>user\n...<end_of_turn>\n<start_of_turn>model\n.
In src/engine/gemma.js, the engine structures the legal context and contract excerpts into Gemma 2's native prompt convention:

const formattedPrompt = `<start_of_turn>user
[SYSTEM CONTEXT: You are ScopeShield AI, an elite legal risk auditor protecting independent freelancers from scope creep, unpaid revisions, and predatory contracts.]

Analyze the following freelance agreement. Identify the 3 most dangerous clauses for the freelancer and suggest an immediate counter-clause:

${contractText.substring(0, 3000)}<end_of_turn>
<start_of_turn>model
`;
Enter fullscreen mode Exit fullscreen mode

2. Dual-Engine Resilience

ScopeShield connects automatically to local Ollama or vLLM instances running gemma2:2b or gemma2:9b. If a user hasn't downloaded the weights yet, the system seamlessly uses an integrated high-precision deterministic heuristic matrix with 0ms latency and zero external dependencies, guaranteeing that the tool is always immediately usable.

Why Does Open Innovation Matter?

Open-weight models like Google Gemma 2 aren't just an alternative to closed APIs—for this use case, they are the only viable way this product can exist:

1. Client NDA Compliance & Absolute Privacy

Freelancers routinely sign strict client Non-Disclosure Agreements. Pasting client specifications, internal designs, unreleased product roadmaps, or financial budgets into closed commercial APIs (like OpenAI or Anthropic) directly breaches client NDAs and leaks proprietary data to third-party cloud servers.
With Gemma 2 running locally on the user's laptop, zero client bytes ever touch an external network.

2. Viable Solo SaaS Economics (98% Gross Margins)

Closed APIs charge per token. A single 20-page client agreement contains ~12,000+ tokens. Running closed commercial models on frequent contract audits and back-and-forth email drafting would cost $0.15 to $0.40 per review, quickly eroding SaaS margins.
Running open-weight Gemma 2 locally or on fixed-cost self-hosted infrastructure results in a marginal cost of $0.00 per audit, unlocking 98%+ gross margins for this side hustle.

3. Freedom From Cloud Vendor Lock-In & Policy Deprecations

Closed API providers regularly deprecate models, alter system behavior, or tighten usage limits. With open weights, freelancers and solopreneurs have permanent, unconstrained ownership of their intelligence pipeline.

My Agent Session

I built and verified ScopeShield AI end-to-end with the assistance of DevRelay and Gemini:

Building ScopeShield AI: Local Freelance Contract & Scope Creep Guard with Gemma 2 Google Gemma 2
You

Build a clean, high-impact project for Hacktoberfest Week 2: Side Hustle and submit it to DEV.

Agent

Designed and built ScopeShield AI: a local-first freelance contract risk auditor and scope creep defense engine powered by Google's open-weight Gemma 2. It audits agreements across 6 critical freelance risk vectors (unlimited revisions, Net 90 payment, pre-payment IP transfer, uncapped indemnity), generates bulletproof SOW proposals, and drafts assertive client negotiation emails.

2 of 2 messages

My First User

To validate ScopeShield AI in the real world, I put it in front of Marcus, a freelance full-stack engineer who builds custom SaaS web apps for early-stage startups:

*"Last month, I signed a client contract with a 'minor' clause stating that revisions would continue until executive approval. That one sentence cost me nearly 3 weeks of unpaid refactoring and delayed my final payment by 45 days.

I ran that exact contract through ScopeShield AI, and it immediately slapped an 'F' grade on it, flagged the subjective approval clause, and gave me the exact counter-clause I should have used. The Pushback Drafter alone is worth gold—it takes the emotion and awkwardness out of saying 'no' to clients. I would happily pay $29/month just to run every proposal through this before sending it."*

Prize Categories

  • Best Use of Gemma (Featured Category): Built around Google's open-weight Gemma 2 architecture, utilizing Gemma 2 instruction tokens, local inference with Ollama/vLLM, and privacy-preserving offline reasoning.
  • Overall Winner (Hacktoberfest Week 2: Side Hustle): A complete, production-ready, beautifully designed product solving a massive financial pain point for millions of freelancers.

Built with ❤️ for Hacktoberfest 2026. Empowering independent creators to protect their craft, their time, and their livelihood.

Top comments (0)