SPECTRE — Hidden Content Revealer

Detect hidden prompts, invisible text, and concealed instructions buried in documents. SPECTRE scans files entirely in-browser — nothing is uploaded to a server.

What It Detects

Technique	Formats
White / invisible text	DOCX, PDF
Vanish (hidden) runs	DOCX
Micro font (< 2 px)	DOCX, PPTX, PDF
Off-page content	DOCX, PPTX, PDF
Text behind images	PDF
Zero-width characters	DOCX, TXT, MD
Unicode invisibles & homoglyphs	TXT, MD
BiDi override abuse	TXT, MD
HTML comments	TXT, MD
Tag characters	TXT, MD
Metadata injection	DOCX, PPTX, PDF, MD

Supported File Types

.docx · .pptx · .pdf · .txt · .md

Getting Started

Prerequisites

• Node.js 18+
• npm

Install & Run

git clone https://github.com/aqeelabpro/spectre
cd spectre
npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables

Copy the example env file and add your keys:

cp .env.example .env.local

Variable	Required	Description
RESEND_API_KEY	Optional	Resend API key for the feedback form
NEXT_PUBLIC_SITE_URL	Optional	Deployed URL for SEO meta tags

The app works fully without any env vars — feedback emails just won't send.

Production Build

npm run build
npm start

Deploy on Vercel

The easiest way to deploy SPECTRE is on Vercel:

Or deploy via the CLI:

npm i -g vercel
vercel

After deploying, add your environment variables in Vercel Dashboard → Settings → Environment Variables.

Tech Stack

• Framework — Next.js 16 (App Router, Turbopack)
• Language — TypeScript
• Styling — Tailwind CSS 4
• Icons — Lucide React
• Email — Resend (feedback form)
• Processing — 100% client-side (no server uploads)

Project Structure

app/
  page.tsx              # Main scanner UI (drag-and-drop, results, feedback widget)
  layout.tsx            # Root layout, SEO metadata, Open Graph tags
  globals.css           # Theme variables, animations, Tailwind config
  icon.svg              # App favicon
  api/
    feedback/
      route.ts          # Feedback email endpoint (Resend)
lib/
  parser.ts             # Entry point — routes files to format parsers
  types.ts              # Shared types (Finding, ParseResult, HiddenType)
  unzip.ts              # In-browser ZIP extractor for OOXML formats
  utils.ts              # Tailwind class merge helper
  parsers/
    docx.ts             # DOCX hidden content parser
    pptx.ts             # PPTX hidden content parser
    pdf.ts              # PDF hidden content parser (FlateDecode decompression)
    plaintext.ts        # TXT / Markdown hidden content parser (9 detection types)

How It Works

1. User drops or selects a file in the browser.
2. The file is parsed entirely client-side — DOCX/PPTX archives are unzipped in-memory, PDFs are decoded from raw bytes, and plain text is scanned character-by-character.
3. Each parser returns a list of Finding objects describing the hiding technique, severity, location, and extracted hidden text.
4. Results are displayed in a tabbed UI: Findings, Hidden Text, Visible Text, and Metadata.

Privacy

• Zero uploads — all scanning happens in your browser
• No tracking — no analytics, cookies, or third-party scripts
• No server processing — documents never leave your device
• The only network request is the optional feedback form

License

MIT