The checks
what each one looks at.

01Three axes, with evidence

A check that did not run is never a pass. The reasons the app shows are: not configured, busy, provider error, no data, check failed, not available on this server, and daily limit reached.

• Safety is OK only when at least one reputation service or the language model answered and no finding is above OK. Local rules alone never give OK.
• Without provider keys (a fresh install, or the demo console) every outside check is listed as not checked and Safety stays at Caution for everything, including a genuine site. The line "OK means no warning signs in the checks that ran" appears only with a Safety OK, so you will not see it until at least one service or the model is switched on.
• Authenticity never reaches Danger: AI detection is a probability, so strong signs show at Caution.
• Truth without a cited source is "No reliable source found". A text with no checkable claim has no truth axis; the app says "No checkable claim found".

02Link

A shortened link is opened first and its destination is checked too. Local rules flag look-alikes of well-known brands, a brand name inside someone else's address, punycode, links to an IP address, text hidden before an @, links to a file instead of a page, and public forms, file shares and page builders (always Caution, see Known limits). Then, if switched on: Web Risk lists for the link and its destination, domain age, and a model's read of what the page asks the visitor to do.

A Web Risk listing, a look-alike of a listed brand, or a page that asks for sign-in or payment details on a domain under 30 days old, on a look-alike, or in the name of a listed brand off that brand's own sites, is Danger. The page is read as text only, through a fetcher that refuses private addresses and caps redirects, time and size. The built-in brand list (server/src/lens/link/brands.json) names the official sites of well-known banks, shops, carriers, operators and authorities, mostly in Slovakia and the Czech Republic; extend it for your market.

03Message

SMS, chat messages and social posts, pasted or shared. Two signals run side by side:

• Scam phrase rules in English, Slovak and Czech, whatever the app's language, plus cues of text that tries to instruct the checker.
• AI read: the language model reports, through a strict schema, what the message asks for (money, sign-in details, a code, an app installation, personal data, moving to another app or number), whether it pressures, which brand it claims to be and the likely scam type.

Each ask, pressure and impersonation is a Caution finding. A request for money, sign-in details or a code is Danger when it comes with pressure, or when the message speaks in a brand's name over an unofficial channel (a link, sender, account or phone number that is not the brand's own). A request to install an app in a brand's name from somewhere other than its own sites or the official app stores is Danger too. A single rule hit never reaches Danger on its own, so a genuine one-time-code SMS stays below Danger. The model's answer can only add findings, never lower them.

Inside the message, up to 5 links go through the link check (the rest are listed as "More links not checked"); phone numbers in Slovak, Czech, UK and international formats are compared with the verified service numbers of the brand; IBANs and Czech and Slovak account numbers are found (and shown only masked), and an account in another country than the brand's is Caution. The text is redacted before any model or service sees it, and findings never quote it.

04E-mail

A shared or picked .eml file (up to 10 MB), or a pasted raw e-mail with its headers. The e-mail file is redacted on the phone before it is sent.

• Sender: a display name that shows another web address than the one the mail came from is Danger; a display name of a listed brand sent from another domain, a Reply-To on another site, or more than one sender is Caution.
• Authentication: only the topmost Authentication-Results header written by the receiving server is read. A failed SPF, DKIM or DMARC result is Caution; a pass is OK; a missing result is listed as not checked. These are local signals and never give OK on their own.
• Body: the subject and the first plain-text part (or the HTML part as text) go through the message check, and the links hidden in the HTML are checked first.

Headers are read defensively: folded lines, encoded names and duplicate headers are handled, and everything is capped, so a hostile e-mail cannot add a header or slow the server down.

05Screenshot

When the language model is set, an image is first read as a screenshot: the model returns the text in it and the kind of screen (chat, e-mail, post, payment confirmation, other). The text is redacted and goes through the message check with its links; text over 200 characters also goes to the claim check. A screenshot of a payment adds a Caution: "A screenshot of a payment is not a payment".

The image checks run as well when the screenshot is not a message (kind "other"), has no readable text, could not be read, is over 7 MB or is not PNG, JPEG or WebP. Without a language model, every image goes to the image checks and "Screenshot read: not configured" is listed. A screenshot costs one media unit, not an extra light check.

06QR code

The code is decoded on the phone by the camera scanner, and its content is shown as text; nothing it holds is opened. "Check it" then starts a normal check of that content: a link goes through the link check, a text through the message check. It costs one light check.

07Image

AI-made and face-swap scores from Sightengine against your thresholds, Content Credentials, the camera maker or editing tool named in the file's metadata (GPS, author and comment fields are never read, and text written into the file is never quoted), and pages where the image appears (Cloud Vision).

Limits: metadata can be edited, so it never counts for more than Caution. The web lookup gives no dates.

08Video

For a video file up to 60 seconds: frame scores for AI generation and face swaps, Content Credentials, and the sound track through the voice check and, with speech to text on, its transcript through the message check. Audio and video need ffprobe and ffmpeg on the server (see Uploads).

Limits: links to video platforms are not downloaded; files only. Frames are sampled, so a short altered moment can be missed.

09Voice message and audio

An AI-speech score for the recording, Content Credentials when the file carries them, and, with speech to text on, a transcript that is redacted and checked like a pasted text (message check, links and, over 200 characters, the claim check).

10Claim or hoax

A pasted text over 200 characters, the text of a screenshot over 200 characters, or a long transcript also goes to the claim check:

1. Claim finding: the language model picks out at most three checkable claims. None found: "No checkable claim found", and no truth axis.
2. Published fact checks: each claim is looked up in Fact Check Tools; only reviews about the same claim count.
3. Cited web research: each claim is researched with a web-search model that must cite its sources; support or contradiction counts only from two or more different sites, and never from a site the checked content itself links to.

Over several claims the worst answer wins. A claim check uses one claim unit from the daily allowance; it is given back when the check could not answer.

11One item, several checks

A check runs in two steps within one time budget, and the person sees one verdict with a card per axis:

A secondary check whose daily allowance is used up is listed as "daily limit reached" instead of running. When no check of the charged kind could answer, the charge is given back; when the person deletes a running check, nothing is given back, because the providers were already called.

12Daily limits

Each check type uses its own daily allowance per install, set in the console's Plans: light checks (link, message, e-mail, QR code, screenshot text), media units (image 1, audio 1 per started minute, video 10 per started 30 seconds), and claim checks. When an allowance is used up, the app says so in a friendly notice and shows when the limits start again; when a provider fails on a media check, its units are given back.