Skip to content

Contract / 2026 / Shipped to web and both app stores

Threat Tracker

Threat monitoring platform for a security company. AI extraction, human approval, shipped to web and both app stores.

  • TypeScript
  • Next.js
  • Expo
  • GLiNER
  • GCP Cloud Run

01 · Problem

A security company needed one place to run threat monitoring. Collect raw reporting from configured sources, work out who and what it mentions, and match it against watchlists. Missing a real threat costs more than reviewing a false one, so the system had to favour recall and keep people in charge of the final call.

02 · What I built

  • An ingestion pipeline collecting from configured sources.
  • GLiNER entity extraction served on GCP Cloud Run, scaling to zero between runs. It pulls people, organisations, locations and vehicles out of raw text and submitted intelligence.
  • Match scoring against watchlists, with thresholds tuned to favour recall. Uncertain matches route to a human review queue. The product literally says "AI-extracted entities require manual approval".
  • A Next.js web platform plus an Expo mobile app, shipped to both app stores, from one TypeScript codebase and design system.
  • LLMs sit in enrichment and summarisation, not in the decision path.

03 · Architecture

Extraction is machine work. Judgement is not. The pipeline narrows from raw text to scored matches, and everything uncertain lands in front of a person.

04 · What happened

Delivered as a contract engineer, client-facing throughout: requirements documents, planning meetings, work estimation. The web platform and both mobile apps shipped. Extraction and matching were checked against hand-reviewed samples.

The client and their operational data stay private. Everything shown here is the mobile app with demo data.

TODO · Clean web platform screenshots with demo data. The web app exists and shipped, but its current captures are not fit to publish.

TODO · Two further mobile captures exist but contain a crude demo entry title. Recapture with clean demo data to include the intelligence feed and alerts screens.

In the product

Sightings with match confidence and verification state. Red watchlist hits surface immediately, uncertain matches wait for a person.
The watchlist. Entities classified red, white or grey, matched by the extraction pipeline.