whatomate - Moses Yebei

The Problem

Organizations that need a WhatsApp Business integration must stitch together separate messaging APIs, authentication, UI dashboards, and analytics. Existing commercial solutions are costly and lock‑in, while open‑source alternatives rarely ship a single binary that includes both API server and a ready‑to‑run UI.

What This Does

whatomate delivers a self‑contained WhatsApp Business Platform. The Go backend (cmd/whatomate/main.go) builds a single binary that embeds the Vue‑based UI (frontend/). Core capabilities such as multi‑tenant data isolation, role‑based access control, webhook handling for Meta’s Cloud API, real‑time WebSocket chat, template & campaign management, and AI‑driven chatbot flows live in the internal/ and pkg/ packages. The docs/ folder holds a static site generated with Astro that documents the REST API and UI features.

Key files:

cmd/whatomate/main.go – entry point, parses CLI flags, runs DB migrations, starts HTTP server.
internal/handlers/*.go – HTTP handlers for agents, analytics, campaigns, etc.
frontend/src/components/** – Vue 3 components (shadcn‑vue) that render the dashboard.
docker/docker-compose.yml – orchestration of the Go service, a PostgreSQL container, and optional Redis worker.

How It Is Wired

Execution begins in cmd/whatomate/main.go. After flag parsing it calls server.Start() (in internal/server). That function:

Loads configuration from config.example.toml (or a user‑provided config.toml).
Initializes the PostgreSQL connection (via pkg/db).
Registers routes defined in internal/router.go, wiring each endpoint to a handler in internal/handlers.
Starts a WebSocket hub (internal/ws/hub.go) that pushes real‑time messages to connected Vue components.

Handlers such as internal/handlers/campaigns.go invoke service layer functions in pkg/service/*, which in turn use repository structs in pkg/repo/* to perform CRUD against the DB. The only circular import detected involves the toast UI (frontend/src/components/ui/toast/index.ts ↔ frontend/src/components/ui/toast/use-toast.ts). The most connected module is frontend/e2e/helpers/index.ts, imported by 13 test pages, indicating a high‑impact area for test‑suite stability.

How To Use It

# Clone the upstream repository
git clone https://github.com/moses-y/whatomate.git
cd whatomate

# Build the single binary (requires Go 1.24+)
make build-prod          # produces ./whatomate

# Prepare configuration
cp config.example.toml config.toml   # edit as needed (DB credentials, Meta API keys)

# Run migrations and start the server
./whatomate server -migrate

# UI is served at http://localhost:8080
# Default login: admin@admin.com / admin

Docker alternative (requires Docker Engine):

curl -LO https://raw.githubusercontent.com/shridarpatil/whatomate/main/docker/docker-compose.yml
curl -LO https://raw.githubusercontent.com/shridarpatil/whatomate/main/config.example.toml
cp config.example.toml config.toml
docker compose up -d

Both paths rely on the embedded frontend; no separate npm install is needed for production runs.

Real‑World Use

A contact‑center can deploy whatomate behind an internal reverse proxy, point the Meta WhatsApp Cloud webhook at https://myhost/api/webhook, and let agents log in via the dashboard. Campaign JSON files can be dropped into a watched directory (handled by internal/worker/campaign_worker.go), triggering bulk sends with automatic retry on failure.

Code Health & Issues

Measured findings (static analysis)

HIGH – Deep nesting (max depth 8) in several Vue view files – refactor with guard clauses.
HIGH – Duplicated 6‑line blocks across 145 test files – extract shared helpers.
HIGH – Import cycle between toast UI modules – break the cycle.
HIGH – Oversized Vue files (> 1 600 lines) – split by responsibility.
MEDIUM – Hub module frontend/e2e/helpers/index.ts (13 dependents) – keep stable, move volatile logic out.
MEDIUM – High branching density in Go handlers (internal/handlers/*.go) – decompose decision logic.

Code‑health audit

HIGH – Pin GitHub Actions to commit SHAs (.github/workflows/*).
MEDIUM – Declare least‑privilege GITHUB_TOKEN permissions (e2e-tests.yml).
MEDIUM – Enable Dependabot/Renovate (.github/dependabot.yml missing).
MEDIUM – Pin Docker base images by digest (docker/Dockerfile).
MEDIUM – Add dependency‑vulnerability scan to CI.
MEDIUM – Set persist-credentials: false on checkout (deploy-docs.yml).
MEDIUM – Run container as non‑root (docker/Dockerfile).
LOW – Define job timeouts in workflows.
LOW – Add convention files (.editorconfig, .gitattributes, formatter config).

Additional observations: tests exist (34 files) and CI runs via GitHub Actions; a license file is present; no secrets were found in the history.

The Bottom Line

whatomate offers a functional, single‑binary WhatsApp Business platform with a complete UI and extensible Go backend. It is production‑ready but carries technical debt: deep nesting, large Vue files, and a few import cycles that will increase maintenance cost. Teams comfortable with Go and Vue can adopt it quickly, especially if they address the high‑severity findings and tighten CI/CD hygiene.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

509 files

Vue262
TypeScript95
Go72
JSON8
YAML6
Markdown3

ReactVueDocker

Module dependencies

The 10 most depended-upon modules of 98, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_frontend_e2e_helpers_index["index"] n1_frontend_e2e_pages_index["index"] n2_frontend_e2e_pages_BasePage["BasePage"] n3_onents_ui_form_injectionKeys["injectionKeys"] n4_tend_e2e_pages_CampaignsPage["CampaignsPage"] n5_ontend_e2e_pages_ChatbotPage["ChatbotPage"] n6_rontend_e2e_pages_DialogPage["DialogPage"] n7_frontend_e2e_pages_FlowsPage["FlowsPage"] n8_frontend_e2e_pages_LoginPage["LoginPage"] n9_ntend_e2e_pages_SettingsPage["SettingsPage"] n4_tend_e2e_pages_CampaignsPage --> n2_frontend_e2e_pages_BasePage n5_ontend_e2e_pages_ChatbotPage --> n2_frontend_e2e_pages_BasePage n6_rontend_e2e_pages_DialogPage --> n2_frontend_e2e_pages_BasePage n7_frontend_e2e_pages_FlowsPage --> n2_frontend_e2e_pages_BasePage n8_frontend_e2e_pages_LoginPage --> n2_frontend_e2e_pages_BasePage n9_ntend_e2e_pages_SettingsPage --> n2_frontend_e2e_pages_BasePage n1_frontend_e2e_pages_index --> n2_frontend_e2e_pages_BasePage n1_frontend_e2e_pages_index --> n6_rontend_e2e_pages_DialogPage n1_frontend_e2e_pages_index --> n8_frontend_e2e_pages_LoginPage n1_frontend_e2e_pages_index --> n4_tend_e2e_pages_CampaignsPage n1_frontend_e2e_pages_index --> n7_frontend_e2e_pages_FlowsPage n1_frontend_e2e_pages_index --> n9_ntend_e2e_pages_SettingsPage n1_frontend_e2e_pages_index --> n5_ontend_e2e_pages_ChatbotPage

Dependencies

18 of 45 declared dependencies are a major version behind. Resolved 45 of 45 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^20.10.0	26.2.0	6 major
`@vueuse/core`	^10.11.1	14.4.0	4 major
`vite`	^5.0.0	8.2.1	3 major
`astro`	^5.0.0	7.2.2	2 major
`pinia`	^2.1.7	4.0.3	2 major
`@vue/eslint-config-typescript`	^12.0.0	14.9.0	2 major
`eslint`	^8.56.0	10.8.1	2 major
`typescript`	~5.3.0	7.0.2	2 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium6

low2

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

docker/setup-buildx-action@v3, docker/login-action@v3, goreleaser/goreleaser-action@v6, golangci/golangci-lint-action@v6

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/e2e-tests.yml

2 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

3 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

docker/Dockerfile

golang:1.24.5-alpine, alpine:3.19

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/deploy-docs.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

docker/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/deploy-docs.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.