Sabuezo - Anti-Fraud WhatsApp Bot for Latin American SMBs

July 28, 2026

Latin America has 32 million small and medium businesses — over 99% of the region's companies and 7 out of every 10 jobs. Almost none of them have a security team, and 60% will face a cyberattack this year. Sabuezo gives the neighborhood print shop, restaurant, and accounting office the same baseline defense a large company has, delivered over WhatsApp in Spanish, with nothing to install.

It combines two defenses that are usually sold separately: the attack coming in, and the open door going out. If your domain has SPF and DMARC misconfigured, anyone can send email impersonating your business — which is exactly why your team keeps receiving phishing that appears to come from your own organization. Sabuezo connects both ends.

Built for the hack@latam 2026 hackathon (DEF/ACC track) and now live across 10 countries.

• WhatsApp phishing detector: Forward a text, link, screenshot, or email and get a verdict in seconds. Trained against real Latin American scam patterns — tax agency impersonation (SAT, AFIP, SUNAT, DIAN, SRI), regional banks (BBVA, Bradesco, Itaú, Bancolombia), supplier fraud, CEO fraud, virtual kidnapping, fake couriers and utility bills, crypto scams, and URL typosquatting
• Multimodal analysis: Handles text, URLs, and images — screenshots of a suspicious chat work as well as the message itself
• Website security scanner: Free, no signup. Checks SSL/TLS, security headers, SPF/DKIM/DMARC email authentication, CMS fingerprinting, exposed files (.env, .git, backups, admin panels), and domain age, then returns a 0–100 score with a prioritized fix list in plain Spanish
• Breach checker: Cross-references an email or phone number against known public breaches and returns a mitigation plan
• Regional awareness: The same bot and number adapt to local fraud patterns per country — tax agencies, banks, and terminology change by market
• Executive reporting: Findings are written for a business owner, not a security engineer — every issue comes with what it means and how to fix it

Three services around a shared Postgres database. A Node.js bot built on Baileys connects to WhatsApp multi-device without a browser, self-hosted. A Python + FastAPI backend runs the analysis pipelines: heuristics tuned for Latin American scams on top of Claude for text classification, Claude vision for screenshots, and a scanner module for SSL, headers, DNS records, and file exposure. A Next.js 16 frontend on Vercel serves the landing page, the public scanner, and per-business dashboards.

Persistence is Supabase Postgres with row-level security across three tables and an aggregate view. The bot and backend write with a service role; the frontend reads with a publishable key. A Cloudflare tunnel exposes the self-hosted API to the Vercel deployment without opening ports.

The scanner is the interesting engineering problem: it has to be fast enough to feel instant in a chat, safe against being pointed at internal infrastructure, and precise enough that a false positive doesn't send a business owner chasing a problem that isn't there.