Loading today’s stories
Build1 distinct publisher3 min readUpdated
A one-German-word-a-day channel took a week, three hosting platforms and a git history rewrite. None of the hard failures were in the AI layer.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A developer writing as btkcodedev published a postmortem of building something deliberately small: a WhatsApp Channel that posts one A1-level German word each morning with an example sentence and a mnemonic [1]. The content generation was a non-event, since Gemini produces that in a second [3]; the week went to WhatsApp's session model, two hosting platforms, and the repo's own history [2][4].
The pivot point is what `whatsapp-web.js` actually is. It drives a real headless Chrome instance that logs into web.whatsapp.com the way a browser does [5], and it works locally [6]. Its persisted auth state is therefore a full Chromium profile: cookies, IndexedDB, cache [7]. His measured 43MB [8]. GitHub Secrets cap out in the kilobytes [9]. That is three to four orders of magnitude of mismatch [4], and base64 makes it worse, not better, because encoding a 43MB tar produces roughly 57MB of text [1].
Which is why the standard tutorial answer exists: tar the profile, base64 it, paste it into a secret anyway, decode it back into place on every CI run [10]. He shipped that, complete with a `setup.ts` whose entire job was printing a giant blob for manual pasting into GitHub's secret editor [11]. It does not fix the failure it appears to fix, because the session expires on WhatsApp's schedule rather than yours, and a phone offline too long kills it [12], which puts you back at a QR code on a server with no screen [13]. According to the author, two things work: run the linking step once locally against the same database the deployed job reads [14], or watch the CI provider's live log stream, where the QR prints as ASCII art you can scan off a terminal [15].
The platform layer failed independently. He had it deployed on Railway, Render and GitHub at once, and none of them worked [16]. Railway's fair-use policy explicitly bans userbots, meaning anything logging into a personal account over an unofficial reverse-engineered protocol instead of a real bot API [17], which is a precise description of `whatsapp-web.js` [18] and not a defect he could patch [19]. On Render he hit `RemoteAuth` with a Mongo-backed store, which has open, unresolved GitHub issues where the session saves but does not reliably restore, silently demanding a fresh QR scan on restart [20].
What stuck was changing libraries. Baileys speaks WhatsApp's multi-device protocol directly over a WebSocket, with no Chromium and no Puppeteer [21], and its session is a handful of small JSON credential files measured in kilobytes [22]. That fits in a free MongoDB Atlas cluster rather than a secret [23], and with no browser to start, it runs on a constrained free tier instead of choking on headless-Chrome memory pressure [24]. The real requirement was about sixty seconds of compute once per 24 hours [25], a 0.07 percent duty cycle [2], so the answer was a GitHub Actions cron job [26]. Dockerfile, Render and Railway all deleted; the deployment surface became one YAML file [27].
The bill came due in git. He had committed a full `.wwebjs_auth` folder, 204 files, plus standalone tar and base64 dumps at 27MB and 41MB [28]. That folder is a live login session, readable by anyone who could read the repo [29], and deleting it from the working tree leaves it in every earlier commit [30]. `git filter-repo` plus a force-push took `.git` from 84MB to 284KB [31], a roughly 300-fold shrink [3].
Worth watching if you are building this: check your host's acceptable-use policy for userbot language before writing code [17], and treat any credential that will not fit in your secrets manager as evidence the architecture is wrong, not as an encoding problem [10].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
The author (dev.to, btkcodedev) set out to build a WhatsApp Channel that posts one German word every morning at A1 level, with an example sentence and a mnemonic.
The project took a week and required a git history rewrite.
Gemini can write the daily word, example sentence and mnemonic in a second; the hard part was never the AI and never the German.
The project became an argument with WhatsApp's session model, two hosting platforms, and the author's own repo git history.
whatsapp-web.js drives a real headless Chrome instance that logs into web.whatsapp.com like a browser would.
whatsapp-web.js works locally; problems begin at deployment.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed but single-source and self-reported
Every factual element traces to one first-person post by the project's own author. The specificity is high — named libraries, byte counts, file counts, a named policy category, a named remediation command — and the mechanisms described (Chromium-profile session size vs kilobyte secret limits, base64 expansion, history-resident git objects) are internally consistent and checkable in principle. But nothing in the cluster corroborates the artifacts independently: the Railway policy text, the open RemoteAuth issues, and the file sizes are asserted, not shown, and there is no second publisher.
One hobby deployment, no third-party uptake data
Adoption evidence is limited to the author's own single-user channel: one GitHub Actions cron job with a Mongo-stored Baileys session, plus two abandoned paid-host deployments and one self-disclosed credential incident. The post asserts that whatsapp-web.js is 'the library most people reach for first' and that 'a dozen tutorials' recommend the base64-secret hack, which hints at wider ecosystem practice, but the cluster supplies no download counts, user numbers, or independent deployments. Nothing here measures adoption beyond n=1.
Slightly understated relative to its own findings
The framing is deflationary rather than promotional: it says outright that the AI was never the hard part, admits implementing the bad workaround, and admits missing a live credential leak until an audit. Several findings are more structurally important than the personal-diary packaging suggests — a host banning userbot workloads by policy, an unofficial client whose session state cannot fit standard secret stores, and committed sessions that survive working-tree deletion apply to anyone wiring consumer messaging into CI. The small offsetting pull toward overstatement is generalisation from one hobby project ('the same wall everyone hits') and the implicit endorsement of Baileys plus free tiers as a durable answer without discussing WhatsApp's own terms or ban risk.
Individual author, audience-building incentive, no disclosed commercial stake
The post is by an individual developer on a community publishing platform describing their own side project. No vendor sponsorship, product launch, funding event, or commercial relationship with Railway, Render, GitHub, MongoDB, Baileys or Google is disclosed or implied in the cluster, and the recommendations point to free tiers rather than to anything the author sells. The residual incentive is reputational: build-log posts reward tidy narratives, dramatic before/after numbers, and confident prescriptions ('this is the actual fix'), which favours a clean arc over ambiguity.
Moderate: coherent mechanisms, unverified specifics, n=1 scope
Confidence is capped by the single-source, self-reported nature of the cluster and by the total absence of independent adoption or verification data. It is lifted by the technical coherence of the account: the claimed failure modes follow from documented properties of the tools involved, the arithmetic checks out, and the author reports against his own interest in two places (implementing the bad workaround, leaking live credentials). The generalisable engineering lessons are more trustworthy than any individual number quoted.
security
Google's reference agent approved a $10,000 refund on a $149 order, on purpose1 distinct publisher
build
A file-copy Allure adapter for Katalon, and the history IDs that make retries useful1 distinct publisher
build
A cleanup commit deleted the sanitizer. Five days later a scanner cashed it in.1 distinct publisher
product
Google gives US students a $200 AI plan free, plus a renewal date and 5TB of switching cost3 distinct publishers
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 15, 2026