# devchallenge #weekendchallenge #hf26challenge Hacktoberfest Weekend Challenge: Build for a Friend 🤝** **This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend** **What I Built** I built ScamCheck for a friend who regularly receives suspicious bank, KYC, delivery, payment and account-warning messages and usually asks me: GitHub: github.com/ansh-rajpoot/scamcheck "Is this real or a scam?" The problem is that simply asking an AI chatbot isn't enough. A chatbot can confidently say "this looks like a scam", but that doesn't tell you why, what can actually be verified, or what is still unknown. So I built something different. ScamCheck investigates the message and shows the evidence. Paste a suspicious SMS, WhatsApp message, email, or URL and ScamCheck breaks it into: suspicious signals it directly observed organizations and claims mentioned in the message URLs and domains external evidence found through web search things that could not be verified safe next steps The AI doesn't get to invent evidence or blindly decide the answer. How it works _**DEMO**_ * The result looks more like a security investigation than a chatbot: * Suspicious signals found * Observed: "Your account will be blocked today" * Observed: OTP requested * Claimed organization: SBI * External evidence: relevant official/public source * Unverified: sender identity * Recommended action: don't share the OTP; verify through the organization's official website/app instead. There is deliberately no arbitrary "87% scam" score. Evidence should be explainable, not a number invented by an LLM. Why Local AI? Scam messages can contain extremely sensitive information: ** 1. - bank details 2. - account suffixes 3. - phone numbers 4. - transaction information 5. - names 6. - addresses 7. - payment information ** ScamCheck uses **Gemma 3 4B **through Ollama, so the AI analysis can run locally on the user's machine. The entire private message doesn't need to be sent to an AI API just to understand it. When external verification is useful, ScamCheck sends a minimal search query rather than the complete private message. That's the part of open-weight AI that mattered to me: the user can actually keep the core analysis at home. _**Why not just use an LLM? Because an LLM shouldn't be trusted with facts it can determine more reliably using normal code. **_ For example: "Enter your OTP immediately" can be detected deterministically. So can: https://example.com/login Gemma is then used for the parts where language understanding is useful: extracting claims identifying claimed organizations understanding requested actions structuring the investigation External search provides another layer of evidence. The final report keeps those sources separate. The Friend Test The real test isn't whether ScamCheck produces a clever AI response. It's whether my friend can paste a suspicious message and understand: "What exactly is suspicious here, what was actually verified, and what should I do next?" That's what I built it for. ## Tech Stack *_Python FastAPI HTML/CSS/JavaScript Ollama Gemma 3 4B SerpApi *_ The application runs locally, with the browser communicating with a local FastAPI server. ## Open Source AI The core AI runs through an open-weight model rather than requiring a proprietary hosted model for the analysis. That means the model can be: run locally swapped for another open model inspected and controlled by the developer used without sending every private message to a third-party AI API For a tool dealing with potentially sensitive messages, that difference matters. What I Learned The biggest lesson was that AI should not be the entire security system. The useful architecture turned out to be: deterministic code + local AI + external evidence rather than: send everything to an LLM and trust its verdict. That made ScamCheck both more explainable and more useful. Limitations ScamCheck cannot guarantee that a message is legitimate or fraudulent. External search results are evidence, not absolute proof. It also does not automatically access WhatsApp, Gmail, Telegram, or other private accounts, and it does not automatically open suspicious URLs. The goal is to help a person investigate safely—not pretend that an AI can know everything. Prize Categories Gemma — Best Use of Gemma SerpApi — Best Use of SerpApi

Making a dog talk with zero backend: in-browser segmentation, WebGL lip sync and real MP4 export DEV Weekend Challenge: Dog Days Edition Submission 🐕 Amandeep Singh Amandeep Singh Amandeep Singh Follow Aug 16 ## Making a dog talk with zero backend: in-browser segmentation, WebGL lip sync and real MP4 export #devchallenge #weekendchallenge #ai 6 reactions Add Comment 6 min read