ParcelGuard

Who it's for

anyone receiving FedEx/UPS/USPS/Amazon delivery mail who currently clicks raw links in Gmail/Outlook/Apple Mail

The problem

time (phishing recovery) + legal/financial (account takeovers from fake ship notices)

How to build it

Chrome/Firefox MV3 extension + optional Gmail add-on; local regex + public carrier track APIs only

Why it doesn't exist yet

carrier track pages deliberately fragment and rate-limit to block scrapers; liability fear kept big security vendors away from rewriting live email links until the 2026 coordinated camera/phish wave made the pain acute enough for an indie to ship a narrow allowlist tool

First users

HN/security Twitter users who just read the FedEx phishing post and install from the thread

Build size

1 person x 5 weeks

Biggest risk

carriers change DOM or add captchas; false-positive rewrites could annoy power users into uninstall

Conditions for a hit (all 3 required)

• rewrites any non-allowlisted shipping domain link in-place to the official carrier track URL using extracted tracking number
• performs a background HEAD/status check on the official endpoint and badges the email with green/yellow/red before click
• all parsing and API calls happen client-side; zero email content leaves the browser

How it's judged (in 6 months)

Chrome Web Store 10k+ active users or GitHub 1,000 stars(judgment date 2027-02-06)

AI self-confidence 48/100 — self-reported likelihood of meeting the criterion, not a business success rate