CakeOrFakeAI-Powered Upwork Applicant Screening Chrome Extension

Upwork recruiters posting jobs receive dozens to hundreds of freelancer applications per listing. Manually reading each proposal, evaluating portfolios, checking for red flags, and comparing candidates is an exhausting, time-consuming process that often leads to poor hiring decisions due to reviewer fatigue. Recruiters needed a way to quickly identify the best candidates without sacrificing evaluation quality. The solution also had to work seamlessly within Upwork's existing interface — recruiters shouldn't have to leave their workflow or copy-paste data into external tools.

Scope: Chrome Extension (Manifest V3), 35 Firebase Cloud Functions, 3 OAuth integrations, Stripe/RevenueCat payment system, Klaviyo email automation, affiliate tracking system, Firebase Hosting for purchase pages

Key features

• AI Applicant Analysis with GPT-4 scoring
• Red Flag & Green Flag detection system
• Score Injection directly into Upwork dashboard
• Sherlock Deep Research — deep-dive candidate profiling
• Personalized interview/outreach message generator
• Professional rejection message generator
• Multi-provider authentication (Google, Facebook, Apple)
• Credit-based billing with RevenueCat + Stripe
• Real-time credit balance management with deficit protection
• Intelligent result caching to reduce API costs
• Analysis history and report management
• Candidate tagging and rating system
• Affiliate referral system with conversion tracking
• Klaviyo email automation (welcome, purchase, re-engagement)
• Push notification support via FCM
• Custom red/green flag configuration per user
• Report deduplication and cleanup
• Issue reporting system

Built a Chrome Extension using Manifest V3 that injects directly into Upwork's recruiter dashboard. The extension scrapes applicant proposal data from the page, sends it to Firebase Cloud Functions for AI analysis using GPT-4, and receives back scored results with detailed red/green flag breakdowns. Scores are injected back into the Upwork DOM so recruiters can see AI ratings alongside native Upwork data. Implemented a credit-based monetization model with RevenueCat/Stripe for payments, Firebase Auth supporting Google, Facebook, and Apple sign-in, and Klaviyo for automated email marketing flows. Added advanced features like Sherlock Deep Research for in-depth candidate profiling, personalized message generators for outreach and rejections, and an intelligent caching layer to minimize API costs.

Built to a standard

• Live on Chrome Web Store
• Production Firebase Backend
• HMAC-SHA256 Webhook Security
• Timing-Safe Auth Verification
• Atomic Credit Transactions
• 5s Timeout on All External Calls
• Fire-and-Forget Non-Critical Paths
• High performance
• Accessible
• TypeScript
• Tested
• Responsive
• SEO optimised
• Secure

1. Problem

   Chrome Extension + Firebase Auth integration across 3 OAuth providers

   Solution

   Built a dual-method auth flow using chrome.identity.getAuthToken with launchWebAuthFlow fallback, supporting Google, Facebook, and Apple sign-in with custom token generation on the backend

2. Problem

   Injecting AI scores into Upwork's dynamically-loaded DOM

   Solution

   Developed a content script with MutationObserver that detects applicant cards as they load, matches them to cached analysis results, and injects score badges without breaking Upwork's UI

3. Problem

   Managing credit-based billing with atomic transactions

   Solution

   Implemented Firestore atomic transactions for credit deduction and addition, with deficit protection, idempotency checks on purchases, and a RevenueCat webhook with HMAC-SHA256 verification

4. Problem

   Stripe price immutability when updating product pricing

   Solution

   Created versioned product identifiers (v2) in both RevenueCat and Stripe, updated offering configurations, and maintained backward compatibility in webhook handlers

5. Problem

   Non-blocking third-party integrations (Klaviyo, affiliates) in critical paths

   Solution

   Implemented fire-and-forget pattern with 5-second AbortController timeouts, email guards, and 24-hour cooldowns to prevent event spam while ensuring core operations never fail due to third-party outages