Deadbolt
Are the photos actually from the city they claim?
Facebook housing groups are full of rental scams. Someone grabs photos from a real listing in one city, reposts them as a sublease in another, and asks for a Zelle deposit before you can tour. Deadbolt is a Chrome extension that checks the photos against the claimed location and gives you a risk score with evidence you can go verify yourself.
Built at HackMIT 2026 with Valerie Eng. Source on GitHub.
Why not just reverse image search it
That's the advice everyone gives, and we started by building exactly that. Two problems. Nobody actually does it, and more importantly it answers the wrong question. Reverse image search tells you where else a photo has appeared. It doesn't tell you whether the apartment is in the city the post claims. A photo can be completely original and still not be the place you're being offered.
So Deadbolt asks the other question. Given these photos and this claimed address, is the construction in frame plausible for that place?
Try it
Click a post.
Both reports above are real output, saved from live runs against the OpenAI API. This page is static so there's no key sitting on a public server, which means it replays saved results instead of analyzing new photos. Clone the repo and you can point it at any listing you want.
What it looks at
| location plausibility | Building stock, heating type, window systems, and whatever is visible out the windows, against the claimed city. The post above claims a third-floor triple decker in Allston. The photos show floor-to-ceiling aluminum glazing and central forced-air ceiling registers. Triple deckers are 1900s wood frame with double-hung sash and steam radiators. |
| unit coherence | Clusters photos by flooring, cabinetry and window system. Four photos of three apartments isn't a listing of the one you'd rent. |
| photo style | Agency real estate photography turning up on a person-to-person sublet. |
| text patterns | Poster abroad, Zelle before viewing, keys by mail, urgency, rent under market. Every flag quotes the post. |
| EXIF | GPS, camera, editing software. Runs locally, no API call. |
| perceptual hash | The same photo recropped to pad out a thin set. |
How it's put together
browser tab
content.js point at a post, walk up the DOM to the smallest
container with images + text, grab that subtree
bytes via fetch -> service worker -> canvas
|
v
localhost:3000
imaging.js EXIF + 64-bit dhash + 1024px downscale (local, no network)
vision.js one json_schema request -----------------> OpenAI API
analyze.js weighted score, sorted findings
cache/ keyed on image hash + normalized text
|
v
render.js shadow-dom panel
Post selection doesn't use selectors. We pulled up a real saved Facebook group feed and
role="article" appeared exactly once in the whole page, so matching on markup was
out. You point at a post instead, which has the side effect of working on Craigslist and Zillow
too.
The model never returns a verdict. It returns evidence, and the scoring happens in our code with weights we set. EXIF and the hash don't touch a model at all, so a report is never empty even if the API is down.
Limits
This reports evidence, not proof. A high score means go see the place in person and don't wire anyone money. It is not an accusation against a specific person, and the tool is deliberately weighted to clear honest posts as readily as it flags bad ones. The clean listing above scores 12 with zero fraud flags.
Location checking is about plausibility, not identity. "Could this be Allston?" is answerable from an interior photo. "Where is this?" usually isn't, and a tool that guessed at it would be confidently wrong a lot.