TRIAGE CONSOLE

Evidence-backed scam triage in one click

Open-source analyzer for suspicious emails, texts, URLs, and phone numbers. Paste it, run analysis, get a verdict built from evidence — an unknown is never marked safe.

View on GitHub
SignalVault screenshot

Features

Header forensics

RFC 822 parsing with folded headers, SPF / DKIM / DMARC result analysis, and sender vs Reply-To comparison.

URL & sender intel

Direct-IP, punycode, shortener, user-info, suspicious-TLD and lookalike detection across extracted URLs, domains, emails, and phone numbers.

Threat-feed screening

Cloudflare malware/phishing DNS checks, Quad9 threat blocking, RDAP domain age, and optional VirusTotal, Web Risk, and AbuseIPDB.

Honest risk scoring

Urgency, credential, payment, and irreversible-payment scoring — verdict aggregation that never turns an unknown into 'safe'.

Zero-config triage

Regex detectors, extraction, and lookalike checks run right in the browser with no accounts or API keys.

Owner-scoped storage

Reports saved to a private Supabase workspace with row-level security, or locally in your browser.

Screens

Triage console — investigation queue with verdict and confidence
Triage console — investigation queue with verdict and confidence
Evidence detail — sender vs link domain mismatch surfaced automatically
Evidence detail — sender vs link domain mismatch surfaced automatically
Source view — every extracted observable from the submitted message
Source view — every extracted observable from the submitted message
Private workspace — owner-scoped storage, signed in
Private workspace — owner-scoped storage, signed in

Get started

  1. Clone the repo — git clone https://github.com/p-romeo/signal-vault
  2. Install & run — npm install && npm run dev (Node.js 22+)
  3. Optional: add keys — Google Web Risk, VirusTotal, or AbuseIPDB keys go in .dev.vars for deeper reputation checks.
  4. Analyze — Paste any email, URL, SMS, or phone number and hit Run one-click analysis.

About the project

SignalVault supports decisions but never guarantees something is safe — failed or missing provider results stay explicit. The worker never visits submitted destinations, and evidence stays in your own workspace.