ApplySafe

Canada-first checker for job and recruiter fraud aimed at international students.

Paste a posting or message, or scan the current tab, and get scam / risky / unclear / looks-ok, with the phrases highlighted.

Status: the paste site is public at https://applysafe.vercel.app. The Chrome extension is public at version 0.2.0: https://chromewebstore.google.com/detail/applysafe/mjgkehogloekmonnmkkmcpjnibamahjp. Hugging Face upload is not done. A new Cursor chat should read docs/handoff.md.

What it is

• Rules (judge) — public CAFC / IRCC red flags (SIN too early, Interac mule, paid LMIA, and the rest). A hard hit is scam.
• Brain (helper) — TF–IDF + logistic. It can lift an unclear result to risky when p_scam is at least 0.75. It cannot cancel a hard hit.
• API — GET /health, GET /v1/rules, POST /v1/scan
• Chrome MV3 — Scan on LinkedIn, Indeed, and Indeed.ca. Rules run on the device.
• ApplySafe-CA — 500 synthetic rows. The code is MIT. data/gold/ is CC BY 4.0.

Not in this build: a live domain-age lookup.

Run the site and the API

The request and response fields are in docs/api.md.

cd apps/web
npm install
npm run dev

Open http://localhost:3000. The brain uses the repo .venv (scikit-learn). If that Python is missing, the page still returns the rules verdict.

Vercel

vercel.json at the repo root is the project Vercel should import. Leave the root directory at ./.

The public site is the web service (apps/web) on every path. The brain service (packages/brain) stays internal. The site calls it through BRAIN_URL, which Vercel injects. Do not set BRAIN_URL yourself. On this machine, with that variable unset, the page still runs the local Python brain. The demo key stays ask_demo unless APPLYSAFE_DEMO_KEY is set in the project env.

curl -s http://localhost:3000/v1/scan \
  -H "Authorization: Bearer ask_demo" \
  -H "Content-Type: application/json" \
  -d '{"text":"send SIN on Telegram","include_brain":true}'

The demo key allows 30 scans in 10 minutes. Set APPLYSAFE_DEMO_KEY to change it. Each scan appends a hash, the verdict, and the rule ids to logs/scans.jsonl. The message is not stored.

Extension

Load steps, permissions, and the offline scanner are in docs/extension.md.

1. Open chrome://extensions and turn on Developer mode.
2. Load unpacked and choose apps/extension.
3. Open a LinkedIn or Indeed job page and press Scan.

apps/extension/applysafe-extension-0.2.0.zip is the folder packed for the store. The public listing is version 0.2.0.

Holdout

On the frozen 50 (as-ca-0001–as-ca-0050), scam versus other:

Caller	Precision	Recall
Rules	1.00	1.00
brain_v1	1.00	1.00
Rules + brain	1.00	1.00
ChatGPT pass	1.00	0.92

The full table, including a 346-ad EMSCAD slice the shipped brain was not allowed to memorize, is in eval/report.md.

Docs

• Plan · Research · API · Extension · Dataset howto · Gold card
• Proposal PDF: open docs/proposal.html → Print → Save as PDF
• Professor email: on hold until there is a live demo (docs/email-prof-usama.md)

Report real fraud: Canadian Anti-Fraud Centre · 1-888-495-8501

Author

Muhammad Umer Aamir · MAC, Wilfrid Laurier University (Brantford)