Hey developers,

I wanted to share a Node.js project I recently built to protect my parents from daily SMS and link fraud: a real-time text threat analyzer. It parses incoming texts, links, and screenshots forwarded by family members through a chat webhook and detects fraudulent templates.

Note: The repository is currently private to protect API webhook endpoints and config keys, but I've detailed the full system design and latency optimizations below.

🛠️ The Architecture & System Flow:

1. Incoming Webhook: Message payload is sent to our Node.js Express server.
2. Validator & Parser: Extracts message strings/links, and hashes the sender's phone number instantly using SHA-256 (privacy-first).
3. Threat Check Parallel Pipeline:
   • Queries a local heuristics pattern blacklist (0ms cache check).
   • If links exist, fires parallel HTTP HEAD requests with a 1.5s timeout.
   • Sends structured payload to Gemini 2.5 Flash for threat modeling.
4. Database Logging: Shipped logging and user quota updates run as background async promises in parallel with the AI check.
5. Response Dispatch: Generates customized warnings and fires the webhook response.

⚡ How I Tuned Latency (From 10s down to <2.5s):

Initially, checking a scam took forever due to network timeouts on dead links and sequential database reads. I optimized it by:

1. In-Memory Whitelist Cache: Cached our system maintenance configurations and developer test whitelists in-memory, cutting DB lookup times to 0ms.
2. Parallel Database Writes: Shifted logging and user quota updates to run in parallel with the AI request rather than blocking it.
3. TCP Keep-Alive: Enabled connection reuse on outbound HTTPS agents to save SSL handshake overhead.
4. Native JSON Mode: Configured the LLM call with native JSON Mode to avoid parsing surrounding markdown blocks.
5. DNS & Redirect Cap: Capped URL resolver requests to a 1.5s timeout, skipping secondary GET fallback retries if the initial HEAD request fails on dead domains.

🛡️ Prompt Injection Defense:

To prevent input messages from overriding system instructions, I pass core threat classification rules natively inside the system guidelines parameters of the LLM configuration. This isolates the system constraints completely from user input.

I'd love to hear your thoughts on how to optimize webhook queues or manage concurrency under high traffic!