Sentrov | Devpost

Inspiration

Phishing emails are getting harder to recognize, especially with AI making scam messages more convincing. We wanted to build something that could help people who aren't cybersecurity experts, especially seniors, understand whether an email is actually safe before clicking a link, sending money, or giving away personal information.

Instead of expecting users to learn every phishing tactic, we built Sentrov to bring the security check directly into Gmail.

What it does

Sentrov is an AI-powered phishing shield that works directly inside Gmail through a Chrome extension.

When a user opens an email, Sentrov adds a simple Scan Email option. With one click, it analyzes the email's sender, subject, and content and returns one of three results:

Safe, Potential Scam, or High Risk.

Instead of only showing a score, Sentrov explains why an email may be suspicious and points out warning signs in simple language.

Sentrov also has a companion website where users can paste suspicious content or upload a screenshot to check something outside of Gmail.

How we built it

We built Sentrov as a Manifest V3 Chrome extension integrated specifically with Gmail.

The extension detects opened Gmail messages and securely sends the relevant email content to our backend using an HTTPS POST request. The backend analyzes the message using Google Gemini and returns a risk classification, score, explanation, and warning signs.

We also built a local heuristic detection system as a fallback so the product isn't completely dependent on the AI model.

The companion website was built with React, TypeScript, Vite, and Tailwind CSS. The backend and scanning API are deployed through Vercel.

We were also careful about privacy. Sentrov doesn't place email contents inside URLs, the Gemini API key stays server-side, and the Chrome extension only requests access to Gmail and the Sentrov backend rather than broad browser access.

Challenges we ran into

One of the biggest challenges was integrating with Gmail reliably. Gmail is a dynamic web application, so navigating between emails doesn't behave like loading normal webpages. We had to make sure Sentrov could detect when the user switched messages, inject the scanner in the correct place, and avoid creating duplicate scanners.

Another challenge was balancing AI-based detection with reliability. A phishing detector shouldn't blindly depend on one model response, so we added heuristic analysis as a fallback and designed the results to explain the reasoning instead of just saying whether something is safe.

We also spent time minimizing Chrome extension permissions because security software shouldn't introduce unnecessary privacy risks of its own.

What we learned

We learned a lot about Chrome Manifest V3 extensions, Gmail DOM integration, serverless APIs, AI-assisted security analysis, and designing cybersecurity tools for nontechnical users.

More importantly, we learned that identifying a threat isn't enough. If the user doesn't understand why something is dangerous, the product isn't doing its job. That pushed us to focus heavily on making Sentrov's results understandable instead of overly technical.

What's next for Sentrov

Next, we want to improve Sentrov's phishing detection using more scam patterns and real-world testing, expand protection beyond email, and continue improving accessibility for seniors and other users who may be common targets of online fraud.

The long-term goal is simple: give anyone a second opinion before they trust something online.