ZeroRisk Sentinel
The Spark
Every day, millions of people download files and click links without knowing what's really lurking inside. I got tired of seeing friends get burned by fake PDFs that were actually executables, or phishing links that looked just close enough to the real thing. ZeroRisk Sentinel started with a simple question: what if you could peek inside a file without ever running it?
No sandboxes. No execution. Just pure static analysis that tells you "this looks sus" before you double-click.
What It Actually Does
ZeroRisk Sentinel is a client-side security scanner that analyzes files and URLs in your browser—nothing gets uploaded to any server.
For files: It cracks open the binary, checks headers against known signatures, hunts for keylogger patterns, spots extension spoofing (like invoice.pdf.exe), and flags suspicious code structures. It even handles APKs through an optional backend that inspects Android permissions.
For URLs: It runs heuristic checks—HTTPS validation, phishing keyword detection, brand impersonation attempts, suspicious TLDs, obfuscated shorteners—then gives you a risk score and plain-English explanation of why that link might be trouble.
Two scan modes: Quick Scan for rapid sampling, Deep Scan for thorough streamed analysis. Your choice.
How It Came Together
Built the frontend with vanilla HTML/CSS/JS—no frameworks, no bloat. Added a Matrix-style background because cybersecurity tools should feel like cybersecurity tools. Tailwind for styling, Anime.js for smooth transitions, ECharts for threat visualizations.
The tricky part was making it all run in the browser. FileReader API for slicing binaries, regex patterns for signature matching, and careful chunking so we don't choke on massive files. For APK analysis, I wired up a lightweight Python backend using androguard to extract permissions without executing anything.
The URL analyzer is entirely client-side. Parses the structure, runs weighted heuristics, and generates AI-assisted explanations (with graceful fallback to heuristic summaries if the AI service is down).
The Battles
Browser limitations were the first boss. You can't just fopen() in JavaScript. Had to learn the FileReader API inside out, handle async chunking, and make sure we don't lock up the UI on large files.
False positives nearly broke me. Early versions flagged every JavaScript file as suspicious because of eval() detection. Spent days tuning severity weights and adding context checks—network activity in a JS file is different than in a CSS file.
The APK backend was a saga. androguard is powerful but finicky. Had to wrestle with temporary file handling, cleanup on crashes, and keeping the API surface minimal so it doesn't become a malware distribution vector itself.
Making it feel legit. A security tool needs visual authority. Iterated hard on the threat meter animations, the terminal console aesthetic, the color-coded severity badges. If it looks like a toy, nobody trusts it.
Wins Worth Bragging About
- 100% client-side file analysis—your data never leaves your machine
- Real-time threat visualization with animated orbital charts showing risk proximity
- Explainable results—every flag comes with a human-readable why
- Demo mode with safe sample files so users can test without risk
- Mobile swipe navigation because yes, people scan files on phones
Most importantly: it actually catches stuff. Extension spoofing, RTL override attacks, permission abuse in APKs—things that slip past casual inspection.
Lessons Learned
Static analysis is underrated. Everyone wants AI-powered behavioral detection, but pattern matching on headers and strings catches 80% of amateur malware without any execution risk.
UX matters more than features. A scanner that spits raw hex is useless to normal humans. Every finding needs context: what was detected, why it matters, and how confident we are.
Graceful degradation is key. The AI explainer is nice, but the tool works offline with heuristic explanations. Backend down? No problem. Browser-only? Still functional.
What's Next
- Sandboxed dynamic analysis as an optional layer for uncertain files
- Expanded format support—Office docs, PDF internals, more archive types
- Verifiable reports—cryptographically signed analysis results you can share
- Community signatures—crowdsourced detection patterns
ZeroRisk Sentinel will stay true to its roots: transparent, explainable, and user-controlled security. No black boxes. No forced cloud uploads. Just clear answers about what you're about to open.
Built for the paranoid. Designed for everyone.
Log in or sign up for Devpost to join the conversation.