Home ScamShield Companion
ScamShield Companion
Scorecard
65/ 100
Stage: Beta on our own rubric. Google Play: Not on Play.
Primary journey: shown with sample data
Scored 2026-11-08 on our own rubric; repository at commit ff87049.
What we promised, and what we have not finished. We promised one public rubric for every product, a list of what is not finished on every page, and a named source for every number. Most of these products are not finished, and each page says where it stops. Read the rubric or every claim and its source.
Recorded 2026-11-01. The narration says nothing leaves the device and the header on screen says the app is offline and private. Corrected 2026-11-07: that is not verified. No network capture of the Android app has been run; offline use was run once in the web build with Chrome's emulated offline mode (2026-11-08). Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.
This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.
Works today
Each line links to the scorecard row that backs it.
Not finished
From the same scorecard, next to the claims.
- No signed release .aab; a debug APK was built once (permissions dump only) and no release build has run
- The QR scanner and the Android share sheet were not run; text recognition (OCR) ran once on one synthetic screenshot and its auto-found boxes were not checked; the redacted-PNG check covers one hand-drawn box in the web build; the money playbook is unit-tested only, its UI not run
- Play listing copy, screenshots and the data-safety form are still missing
- No dark mode; contrast, keyboard and TalkBack not checked; comfort text was measured only at an emulated 320px width, not on a phone
- Offline was run once in the web build with Chrome's emulated offline mode (four tabs and one message analysis); offline OCR, airplane mode on a device and the Android app were not run
- No network capture of the Android app on a device: "nothing leaves the device" is not yet traced (web build walk and debug-APK manifest only)
- The PausePay and Phish or Legit advice, card labels and the Massachusetts crypto-kiosk figure on the STOP screen have no expert review or source check on main; money-playbook step wording not checked against FTC or issuer pages
- Privacy policy contact is still the placeholder [YOUR CONTACT EMAIL] (PRIVACY_POLICY.md:71)
What changed
Dated lines from the scorecard. The source code is private, so these lines are the public record.
- 2026-11-08: Release v0.2.3. The money playbook in First Aid now asks how you paid (card, bank transfer, payment app, gift card, crypto, cash) and shows only the matching steps; unit tests only, UI not run, step wording not checked against FTC or issuer pages (PR 20).
- 2026-11-08: Two more recorded web-build runs: the built app reloads and opens all four tabs with the network off after one visit, message analysis included (OCR offline not covered; emulated offline, not a device) (PR 12); the Phish or Legit deck was played through by button and swipe, progress kept across a reload (PR 25). Neither log states an exit code, so these rows stay Tested with sample data.
- 2026-11-08: Release v0.2.2. Four proof logs were added on main and the README lines scoped to the web build: the saved redacted PNG (black box changed exactly the dragged area, nothing outside it, no metadata chunks; one box, one image), the A/A+ comfort text (16px to 20px, no sideways scroll at 320px, 48px buttons, kept after reload) and the PausePay answer paths and STOP screen. None of the logs states an exit code, so these rows are Tested with sample data, not Proven (PRs 18, 21, 22).
- 2026-11-08: A test now pins the README counts (16 message rules, 4 PausePay questions); vitest 311 passed in the log (PR 16).
- 2026-11-08: The share_target manifest now declares enctype; the Chrome manifest warning went from 1 to 0 and the GET share text still reaches Inspect in the web build. The Android share sheet was not run (PR 27).
- 2026-11-08: CI now runs on the self-hosted runner; the latest run result is not verified (PR 26).
- 2026-11-07: The PausePay STOP screen now has a step to report fraud at ReportFraud.ftc.gov (with a unit test).
- 2026-11-07: Privacy and network claims are scoped to what the code shows, and the README lists what the app does not do. Recorded checks: the built Android debug app declares CAMERA and no INTERNET or SMS permission (not a release build, not run on a device), and a scripted walk through all four tabs including text recognition requested nothing from any host except the app's own origin (web build, one headless Chrome run). Release v0.2.1.
- 2026-11-07: The note under the video now says the narration line "nothing leaves the device" is not verified: no network capture of the Android app has run and offline use is untested. The video is not re-recorded yet.
The next step for ScamShield Companion.
Email us about ScamShield Companion