Recommended Free Tools
A credible serverless forensic-AI dashboard needs more than an image uploader and a model response. Build the browser in Vite and React, keep provider credentials inside Tencent Edge Functions, send compact job data instead of oversized base64 payloads, and treat every AI result as decision support rather than proof. The DF-Analyzer project described by Nori Nofandi is a useful prototype pattern, but its detection accuracy, security posture, privacy controls and forensic validity have not been independently validated.
This guide turns that reported architecture into an implementation plan. It explains the EdgeOne Makers limits that shape the design, the per-image session and IndexedDB approach used after HTTP 431 errors, the controls required for sensitive evidence, and the tests needed before anyone relies on the dashboard for an investigative or legal decision.
As an Amazon Associate I earn from qualifying purchases.
What the dashboard should do
The target is a web application that helps an analyst inspect a media file, collect available metadata, identify signals associated with manipulation, and ask an AI service to explain the findings. The interface can present a timeline of processing, an evidence summary, anomaly indicators and a conversational consultation panel. That is an analysis workflow, not an automatic authenticity verdict.
Free tools Windows power users keep installed
One-click scans. No signup required.
DF-Analyzer is described as a project with a Vite and React frontend, Tencent EdgeOne Makers Edge Functions, an external threat-intelligence or deepfake-detection API, and browser-side IndexedDB caching. The author reports that the application maps findings such as missing EXIF fields or inconsistent lighting into the interface. Those are implementation observations from a personal project account; they are not a published accuracy study or a forensic certification.
#1 Best Overall
“The most significant technical hurdle during the development of DF-Analyzer was managing the conversational state for multiple image files.”
— Nori Nofandi, describing the project
Reference architecture
Browser layer: Vite and React
Use the browser for file selection, preview rendering, progress states and presentation of results. Keep the client responsible for user interaction rather than provider authentication. A React state model should distinguish at least four objects:
- Asset record: a UUID, original filename, MIME type, byte size, an integrity hash and timestamps.
- Analysis record: metadata findings, detector responses, model explanations, confidence labels and the version of each service used.
- Conversation record: messages associated with one asset, with role, timestamp and model or prompt version.
- Audit record: who initiated an action, what endpoint was called, the outcome and any policy decision.
Render a separate workspace for each image. Do not let a single global chat history silently mix evidence from different files.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Edge layer: EdgeOne Makers and Edge Functions
Edge Functions provide the server-side boundary for requests that need secrets, validation or policy enforcement. The reported project uses routes such as /chat and /history. A typical request flow is:
- The browser creates an asset UUID and sends a small job request to an Edge Function.
- The function authenticates the user or session, validates the request and calls the external analysis provider with a server-held credential.
- The function normalizes the provider response into your own schema, adds provenance fields and returns a bounded result.
- The browser stores the permitted result in IndexedDB and displays it with an explicit uncertainty label.
Never put a detector token, model key or unrestricted upstream URL in a Vite environment variable that is bundled into browser JavaScript. Anything shipped to the browser can be inspected.
External analysis services
The project account names Reality Defender as an example of an external deepfake-detection or threat-intelligence integration. Selecting a provider requires a separate review of its API contract, data retention, training use, geographic processing, rate limits, error semantics and independently measured performance. A provider response is an input to the dashboard, not evidence that an image is fake.
Browser persistence
The reported implementation uses one independent session per image, UUID identifiers and IndexedDB caching. This arrangement addresses conversational state without placing every image and every message in one oversized request. IndexedDB is local browser storage, not a secure evidence vault: another process or user profile on the same device may be able to access it, and browser clearing can remove it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Design around EdgeOne’s documented limits
Tencent’s Edge Functions documentation describes a JavaScript runtime on global edge nodes. It lists JavaScript ES2023+ as the supported development language and gives the following limits:
| Constraint | Documented value | Design consequence |
|---|---|---|
| Code package | 5 MB maximum | Keep dependencies lean, avoid bundling model weights and remove unused libraries. |
| Request body | 1 MB maximum | Do not post full-resolution base64 images or unbounded chat transcripts to a function. |
| CPU time | 200 ms per execution, excluding I/O wait | Perform short validation and orchestration at the edge; move heavyweight decoding or inference to an appropriate service. |
| Runtime language | JavaScript, ES2023+ | Use compatible syntax and APIs, and verify third-party packages against the edge runtime. |
| Edge footprint | Tencent reports “3200+ edge nodes”; a publication year was not established | Consider geographic routing, but measure your own users’ latency and error rates. |
The 1 MB limit applies to the request body, not merely the visible file size. Base64 increases binary size by roughly one third before JSON and metadata are added, so a file that looks close to the limit can fail after encoding. The author reports HTTP 431 errors while handling large base64 strings. Treat that incident as a project lesson, not a guarantee that every oversized request will return the same status.
Build the application step by step
1. Create a Makers project
Tencent’s agent documentation presents both a console-template path and a CLI path. A documented starter command is:
edgeone makers create --template openai-agents-starter-nodeUse the console or CLI option that matches your organization, then run the generated project locally. Before adding forensic features, confirm that a minimal function can receive a test request, return JSON and read a secret from the platform’s server-side configuration.
2. Define a narrow API contract
Do not make the browser send arbitrary provider payloads. Define stable endpoints such as:
| Route | Purpose | Minimum request | Important response fields |
|---|---|---|---|
POST /analyze |
Start or perform an analysis job | Asset UUID, content hash, MIME type, size and a permitted object reference | Job ID, provider name and version, status, timestamps |
GET /analysis/:jobId |
Read a completed result | Authenticated job ID | Metadata findings, detector output, provenance and errors |
POST /chat |
Ask an explanation question about one asset | Asset UUID, bounded message and selected findings | Answer, model identifier, safety status and citations to internal findings |
GET /history/:assetId |
Load one asset’s conversation | Authenticated asset UUID | Paginated messages with timestamps and roles |
The exact route names used by your project can differ; the reported application specifically mentions /chat and /history. Keep request and response schemas versioned so a provider change does not silently alter the meaning of stored results.
3. Handle files without crossing the body limit
- Read the selected file in the browser and calculate a cryptographic hash before analysis.
- Record MIME type, byte length, dimensions, filename and capture time when available.
- Reject unsupported types and implausibly large dimensions before any upload.
- Prefer an object-storage upload or a provider-supported upload mechanism that returns a short-lived reference. Send the reference, hash and metadata to the Edge Function rather than embedding the whole file in JSON.
- If a provider requires an image payload, resize or transcode a working copy in a controlled step, document that transformation, and keep the original hash separate from the derivative hash.
- Set explicit timeouts and maximum response sizes for every upstream call.
Do not overwrite the original with a thumbnail. A reduced image may be useful for a detector, but an analyst must be able to distinguish the derivative from the submitted evidence.
4. Isolate conversational state by image
Generate a UUID for every asset and use it as the partition key for messages, analysis jobs and cached results. In IndexedDB, separate stores for assets, findings and messages make it harder to display one file’s conversation beside another’s. Include the asset UUID in every server request and have the function verify that the caller is authorized to read it.
Limit history sent to a model to the messages and findings needed for the current question. Summarize older conversation with a clearly marked, versioned record rather than repeatedly posting an unlimited transcript. This protects the request-body budget and reduces accidental disclosure.
5. Keep credentials and policy on the server
Store upstream keys in EdgeOne’s secret configuration, not in source control or client bundles. The function should enforce:
- Authentication and authorization before reading an asset or history.
- Allowed origins and HTTP methods through an explicit CORS policy.
- Per-user and per-IP rate limits, with separate limits for expensive detector calls.
- Provider allow-lists so a user cannot turn the function into an arbitrary proxy.
- Redacted logs that never include raw images, tokens or full sensitive prompts.
Return a generic error to the browser while keeping a correlation ID for internal troubleshooting. Do not echo upstream error bodies if they may contain credentials, file content or personal data.
6. Normalize provider results
Different services may return scores, labels, heat maps or textual explanations with incompatible meanings. Convert them into a schema that preserves the original response and its interpretation:
- Provider and model version. Record the exact service revision when the provider exposes it.
- Score semantics. State whether a number is a probability, a risk score, a calibrated confidence or merely a ranking signal.
- Input identity. Store the derivative hash or object reference used by the provider.
- Timestamp and region. Capture when and where processing occurred if the service supplies those fields.
- Failure state. Distinguish timeout, rejected format, unavailable provider and an actual negative finding.
Never render a missing response as “authentic.” “No result” and “no detected anomaly” are different states.
7. Present metadata and visual signals carefully
Metadata inspection can expose camera make, software tags, timestamps, dimensions and edit history when those fields survive export. Missing EXIF data is common after messaging, social-media processing or screenshots; it is an investigative clue, not proof of manipulation. Likewise, inconsistent lighting, edges or compression can justify further review but cannot establish who created an image or when.
Give each indicator a plain-language explanation, the source of the observation and a confidence or severity label that does not pretend to be a legal conclusion. Let the analyst open the underlying field or region rather than showing only a red or green badge.
8. Deploy and observe
After local tests pass, deploy with:
edgeone makers deployUse separate projects or environments for development, staging and production. Tencent’s Makers monitoring documentation describes account- and project-level views for traffic, request counts, Edge Functions usage and storage metrics. Set alerts for spikes in rejected requests, function errors, provider timeouts, storage growth and unusually large responses. The project author’s claims about low latency and stable near-real-time API binding are not independently benchmarked, so publish your own measurements by region, file size and provider.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Security and privacy controls for forensic material
Access control
Require an authenticated identity for uploads, analysis results and history. Use least-privilege roles such as analyst, reviewer and administrator. Check authorization on every object lookup; hiding an asset UUID is not access control. Expire sharing links and session tokens, and provide a way to revoke them.
Best Value
Evidence retention and deletion
Define retention before launch. Document where originals, derivatives, metadata, prompts, model responses, logs and backups live; how long each is kept; who can export it; and how deletion is verified. Browser IndexedDB should be treated as a cache with an explicit clear-cache action, not as the authoritative record. If the application handles personal or sensitive imagery, publish the provider’s processing and retention terms to users and obtain any required consent.
Integrity and chain of custody
Hash the original as soon as it enters the workflow and hash every derivative. Preserve immutable timestamps and append-only audit events for reads, exports, transformations and analyst annotations. Keep the original bytes separate from previews. A dashboard that lacks these controls may still be useful for triage, but its output should not be represented as a complete chain of custody.
Input and model threats
- Validate file signatures instead of trusting a filename or client MIME type.
- Defend image decoders against decompression bombs, oversized dimensions and malformed metadata.
- Scan or isolate active content if your workflow accepts archives or documents in addition to images.
- Constrain prompts so text embedded in an image or returned by a provider cannot override system instructions.
- Escape model output before rendering it as HTML, and cap message length.
- Protect against server-side request forgery by restricting outbound destinations and resolving provider hosts safely.
Forensic validity: what the dashboard can and cannot claim
Indicators are not conclusions
Forensic interpretation depends on provenance, acquisition method, file history, corroborating evidence and examiner expertise. An absent EXIF block may result from a routine export. A lighting inconsistency may come from multiple light sources or a panorama stitch. Compression artifacts can be introduced by an ordinary messaging service. The interface should therefore say “indicator requiring review” rather than “fake.”
AI scores need validation
No accuracy metric, calibration study or independent benchmark for the described dashboard is provided. Do not publish a detector score as a validated probability, and do not compare scores from different providers as though they share a scale. Before operational use, evaluate a fixed test set that represents your real image sources, edits, languages, devices and compression levels. Report false positives, false negatives, confidence calibration, abstentions and performance drift over time. Keep a held-out set that is not used to tune prompts or thresholds.
Require human review
Use a two-person review for consequential decisions, record the reasoning behind an escalation and preserve the inputs shown to each reviewer. The model may help explain anomalies or suggest next checks, but a qualified examiner should make the final assessment. If the model cannot identify the input, version or basis for an answer, mark the result inconclusive.
Operational testing before release
A practical release gate should include the following tests:
- Payload tests: verify behavior below, near and above 1 MB, including base64 overhead and long histories.
- Runtime tests: measure CPU-heavy paths against the 200 ms execution budget and confirm that waiting on an external service does not hide unbounded work.
- Concurrency tests: open several image sessions at once and prove that messages and findings never cross asset boundaries.
- Failure tests: simulate provider timeouts, malformed responses, rate limits, revoked credentials and partial uploads.
- Security tests: attempt unauthorized history reads, origin bypasses, prompt injection, SSRF and stored XSS through filenames, metadata and model text.
- Privacy tests: inspect browser storage, logs, traces, backups and provider requests for unexpected image or personal data.
- Forensic tests: use known original, recompressed, resized, screen-captured and edited samples, with labels and provenance documented independently of the development team.
Record test dates, code and provider versions, region, file characteristics and acceptance thresholds. A result that passes in staging should not be treated as a permanent accuracy guarantee; detectors and upstream services change.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCommon failure modes and fixes
| Symptom | Likely cause | Safer response |
|---|---|---|
| HTTP 431 or request rejection | Large base64 image or unbounded conversation in headers or body | Send a short-lived object reference, reduce the working copy, and paginate or summarize history. |
| Correct image, wrong conversation | One global chat state or missing asset key | Partition every record by UUID and verify authorization on reads. |
| Browser exposes a provider key | Secret placed in client configuration | Move the call into an Edge Function and rotate the exposed credential. |
| Function times out or exceeds CPU | Image decoding, model work or a large dependency bundle at the edge | Keep the function as an orchestrator, shrink the package and delegate heavy work. |
| “Authentic” shown after an API error | Empty, null or timeout response mapped to a negative finding | Use explicit states for unavailable, inconclusive and no detected anomaly. |
| Analyst cannot reproduce a result | No input hash, provider version or prompt record | Persist provenance and immutable audit events with the permitted retention period. |
| Unexpected privacy exposure | Raw images in logs, IndexedDB or provider retention | Redact telemetry, limit local caching and document or negotiate upstream data handling. |
How to decide whether the prototype is ready
The architecture is a reasonable starting point when the goal is a responsive triage dashboard with short serverless orchestration. It is not ready for high-stakes conclusions merely because deployment succeeds. Move toward production only when you can answer, in writing:
- Which identities may upload, view, annotate and export each asset?
- Where is every original, derivative, message, log and backup stored, and when is it deleted?
- What exactly does each provider score mean, and what independent data supports its use?
- Can a reviewer reproduce a result from the stored hash, version, input and timestamp?
- What happens when the body limit, CPU budget, provider or browser storage is unavailable?
- Which findings are merely indicators, and which decisions require a qualified human?
If those answers are incomplete, label the application as a prototype or investigative aid. That wording accurately reflects the evidence available for DF-Analyzer: the project demonstrates a serverless implementation pattern and reports practical lessons, while its speed, security, privacy and forensic performance remain to be established through independent testing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
