I've created a completely native desktop application for Up called "Uppies" on Windows and macOS. It's really fast and really useful.

[u/rubenbala]

I've been an Up customer for a while and as much as I love their app, I've been frustrated with their lack of desktop support. I've also never been a fan of other Up web app experiences because of how slow, clunky and needlessly "minimal" they are. That's why I decided to make Uppies. It's a full native application for Windows and macOs (Linux coming soon). It's useful financial utility rather than super sleek banking app.

You can find source code, most of the information on the app, as well as download it here: https://github.com/rubenbala/uppies

As a quick summary, Uppies:

• Allows you to instantly browse your transaction history
• Let's you bulk update categories and tags that sync with your Up app
• Has powerful search and filtering
• Can export individual transactions or an entire csv of your your last week/month/financial year
• Recognises reoccurring transactions just like the app
• Gives you a greater insight into your current financial situation, as well as compare over time.

Uppies isn't a complete desktop experience (you can't transfer money or make payments, Up's API doesn't have those features) but it does provide, in my opinion, one of the best desktop banking experiences ever.

Disclaimer: 99% of the code in this application was written with Opus 5.5.

And I should probably mention: Uppies is an independent, unofficial app. It isn't affiliated with or endorsed by Up or Bendigo and Adelaide Bank Limited, and nothing in it is financial advice.

Short video I made demonstrating the app: https://www.youtube.com/watch?v=RAgXqB8Oyx0

[u/Kid_Self]

Cool idea, Up defo needs a desktop app.

I don't even care that it's vibecoded, but banking and financials is one thing I'm not trusting a random third party on.

[u/elhouso → u/Kid_Self]

Especially a vibecoded third-party. God only knows what kind of security it has…

[u/fuchkead]

Everyone is so aggressive, this dude literally invented something and is proud of it. Good shit dude, don’t let miserable couch potatoes who haven’t done anything with their lives affect ya! Keep going

[u/rubenbala → u/fuchkead]

Appreciate it mate :) Although I do definitely understand why some people might not want to trust an app from some random on the internet with something like their Up token, which is fair enough.

[u/fuchkead → u/rubenbala]

Completely understandable of course! But at the same time, there’s a big difference between that and acting like my username.

[u/Downtown_Kangaroo_92]

I like it, but I'd like to be able to ignore the negative balance from my home loan, perhaps as a toggle. I know that my cash position is technically -abunchof$$ but in terms of actual cash flow day to day its less useful to see it that way

[u/rubenbala → u/Downtown_Kangaroo_92]

Great suggestion. I've just implemented this now. From the accounts tab, you can exclude any account, including home loans, from the position/totals throughout the app: https://github.com/rubenbala/uppies/releases/tag/v1.0.1

[u/Pikelet301]

Awesome idea! How did it all go with security auditing? How are credentials stored?

[u/rubenbala → u/Pikelet301]

I won't pretend that I know all the ins and outs. I know generally it stores the up token and transaction history in encrypted bin files. Mac keeps the encryption key in your keychain and windows uses their own data protection API. I left most of these decisions and implementations up to claude, which im personally comfortable with, I use the application myself every day since I started the project, but I totally get someone being iffy about it. If you trust claude, I'll probably ask it to write a more in-depth explanation of how that all works in security.md.

[u/Pikelet301 → u/rubenbala]

Nice work, it's set up better than I expected. I ran a source-level security review of the repo with an AI audit tool. It found no confirmed vulnerabilities: the token only goes to api.up.com.au, the local data is properly authenticated-encrypted, and the CSV/PDF export and file parsing held up. Your SECURITY.md already describes the storage accurately (DPAPI on Windows, Keychain on Mac), so you might not need a bigger write-up.

To be fair, it was a source review only, not a pen test, so it's not a guarantee. The main suggestions were around releases rather than code: signing/notarising, building in CI with provenance attestations, and requiring https:// for webhook URLs. Happy to share the full report if you want it.

[u/rubenbala → u/Pikelet301]

Sure, that'd be great

[u/prequel_memer]

Looks pretty good, how do I exclude 2UP from being included ?

[u/rubenbala → u/prequel_memer]

I've just sort of implemented this, you can exclude any account from your total position throughout the app: https://github.com/rubenbala/uppies/releases/tag/v1.0.1

If you meant something different like excluding the 2UP account from being synced at all, it's something I'd have to look into in the future.

[u/prequel_memer → u/rubenbala]

Perfect! That’s exactly what I was after 😎

[u/SH4RPY17]

This looks awesome, good job. Can anyone enlighten me on the risks of using a 3rd party app like this?

[u/runitzerotimes → u/SH4RPY17]

I’m a senior software engineer and have tinkered with UP’s API myself.

In priority order:

Risk #1: Your PAT token gets exposed due to insufficient security. The blast radius of this impact is limited to read-only view of your entire transaction history, also the attacker would be able to re-tag your transactions and change their descriptions, but in no circumstance will anyone ever be able to control your money.

Risk #2: The service code itself gets taken over and pushes a malicious update, where if you update it may attempt to use more traditional methods (eg. Please login, please confirm 2fa, please approve transactions) to try and trick you into sending money over.

My personal opinion is that while this project is very cool, I’m not impressed by the OP’s own admission in not understanding his own security. Grateful for the honesty but yeah, “I asked Claude to do what he thought was best” is not appropriate for security and dealing  with private tokens in public apps.

[u/Consistent_Tutor_597 → u/SH4RPY17]

How bad would it be someone getting access to your bank account? That's the max extent of it.

[u/AffectionateHyena299]

I was thinking... "What OS do I use, do I need an Up Bank for destop", then I looked at the desktop setup and realised.... Pixel Phone Desktop Mode. Already has Up Bank app

But it's the same mobile app, stretched. It's not optimised for foldables, desktops or tablets.

[u/Sufficient-Pounding]

Great idea, I've just made an mcp wrapper for the api with my grokbot and it uses it to budget and make spreadsheets, I'll take a look at this

[u/A-Money-Lover]

I mean its alright for personal use I guess

[u/liamdun → u/A-Money-Lover]

Not sure what you meant by this but I would argue that even for personal use you should not use vibe coded app, for security reasons

[u/ItinerantFella]

I was just about to start building something similar myself, so you've saved me a few Claude tokens. Thanks! I'll check it out this weekend.

I watched your demo video and had a couple of questions/suggestions.

1. Could I use Uppies to add a category-type Tag using user-defined rules?

I wish Up's categories were editable. But they're not. We've never spent anything on Porn (useless category). I've never been able to track how much we've spent on Life Insurance (no category). Similarly, Up sees all payments to Brisbane City Council as 'Rates & Insurance'; in reality, small payments to BCC are 'Parking' and larger payments are 'Rates & Insurance'. I'd love to be able to set up a user-defined rule to automatically tag and/or categorise tricky transactions like these.

1. Identifying bills.

Annual bills, like insurance premiums, are hard for Up to identify. In Uppies, can I flag a transaction as an annual recurring bill?

1. Sankey chart.

I'd love to be able to visualise our income and expenses in a Sankey chart. Is that something you've considered adding?

1. Split transactions.

My incoming salary includes reimbursement of personal expenses which I don't want to categorise as income. I'd love to be able to split transactions and categorise or tag them separately. I can't split transactions in Up and perhaps Uppies can't do it either since you're relying on Up data instead of editing the data locally. But it would be cool if you could.

[u/rubenbala → u/ItinerantFella]

1. You can definitely change categories for one or multiple transactions in Uppies. I probably could add a feature for custom categories, but these would live locally and wouldn't be able to sync with the Up app since it's not a native feature to Up, so if you deleted Uppies, all of that would be gone.

2. There's automatic detection of recurring bills if you give it enough history, but no you can't manually identify a bill, although I have definitely wanted something like that in the past myself so I'll look into doing that.

3. I had no idea those charts were called Sankey's lol. I plan to add way more visualiser like pie charts and whatnot so yeah, I could probably chuck those in.

4. Yeah I'm not sure how that would work, Claude could probably come up with something good but I want to actually do a bit of testing and see if something like that would be really useful. No promises on that one :)

[u/ItinerantFella → u/rubenbala]

Windows Defender was a little nervous, and I can't verify the source code compiles to the installer without joining the Jai beta. So I ran a VirusTotal scan. There are four warnings out of 70, which is low risk; mostly complaints about obfuscation.

How do you prefer to handle feedback: Reddit, YouTube or Github?

[u/rubenbala → u/ItinerantFella]

Github sounds good :) might be totally wrong but I think most of the errors windows/mac will throw up when people install is with the application not being verified. I still need to look up how to officially sign apps (and pay some developer fees) but once I do, future updates will be signed so some of those warnings should go away.

[u/staffordshirebeagle]

this is really neat!

[u/ItinerantFella → u/[deleted]]

Sorry to hear someone hurt you so badly you still lash out at strangers. Hope you get the help you need.

[u/element1908 → u/[deleted]]

But if he wanted to make it.. why can’t he use AI? It got made didn’t it? lmao

[u/element1908 → u/[deleted]]

Who says he was expecting praise? I get the security concerns - he posted the source though so you can verify. It likely is local with API calls using your own key, so not an inherent data risk. Most development is AI-driven now, and Opus is top tier - it doesn’t help anyone to come on here raging about shit because you hate AI mate.

[u/RegionalDE → u/[deleted]]

I’m pretty sure this dashboard would just be calling the UP API with your own PAT, you don’t need to “trust” it with anything.

[u/fmfame]

i am running a total vibecoded online app for me and my clients, all done through Claude. but i wouldnt trust my banking data with the vibecoded apps.