Work / Expense tracking bot / 2026
Ledger on WhatsApp
Text a WhatsApp number what you spent and it keeps the books: budgets, transfers, reminders and plain-language answers about your money.
The boundary
Stays inside
- The ledger in MongoDB
- Budgets and reminders
- WhatsApp and model credentials in env
Allowed to cross
- Incoming WhatsApp messages
- Replies and scheduled reminders
The model reads a message and picks an intent. The ledger does the arithmetic.
Context
Expense apps fail because opening them is a chore. Everyone already has a chat open all day.
Idea
Make the chat the interface and keep the model away from the numbers: it classifies each message into one of seven intents, and plain code updates the ledger.
Craft
- Seven intent handlers: expense, budget, transfer, query, reminder, analyst and chat.
- A scheduler sends reminders and summaries on time zones that are set, not guessed.
- Every inbound webhook is verified with an HMAC SHA-256 signature and hmac.compare_digest before a byte is parsed.
- Containerised with a single compose file and deployed to Railway behind a /health check.
Threat model
| Asset | Threat | Control |
|---|---|---|
| Financial history | Model hallucinating totals | Totals computed in code, never by the model |
| Bot tokens | Leak in the image or repo | Env file at runtime, ignored by git |
| Webhook | Forged requests | HMAC SHA-256 signature check, constant-time compare |
Outcome
Deployed on Railway from a Docker image and used through an ordinary WhatsApp chat.