[HN Gopher] Show HN: HCB Mobile - financial app built by 17 y/o,...
___________________________________________________________________
Show HN: HCB Mobile - financial app built by 17 y/o, processing
$6M/month
Hey everyone! I just built a mobile app using Expo (React Native)
for a platform that moves $6M/month. It's a neobank used by 6,500+
nonprofit organizations across the world. One of my biggest
challenges, while juggling being a full-time student, was getting
permission from Apple/Google to use advanced native features such
as Tap to Pay (for in-person donations) and Push Provisioning (for
adding your card to your digital wallet). It was months of back-
and-forth emails, test case recordings, and also compliance checks.
Even after securing Apple/Google's permission, any minor fix
required publishing a new build, which was time-consuming. After
dealing with this for a while, I adopted the idea of "over the air
updates" using Expo's EAS update service. This allowed me to
remotely trigger updates without needing a new app build. The 250
hours I spent building this app were an INSANE learning experience,
but it was also a whole lot of fun. Give the app a try, and I'd
love any feedback you have on it! btw, back in March, we open-
sourced this nonprofit neobank on GitHub.
https://news.ycombinator.com/item?id=43519802
Author : mohamad08
Score : 170 points
Date : 2025-12-03 04:20 UTC (3 days ago)
(HTM) web link (hackclub.com)
(TXT) w3m dump (hackclub.com)
| riffic wrote:
| I really wish something like Hack Club existed while growing up,
| how empowering! great work.
| miroljub wrote:
| Why does it matter how old is the author?
|
| We should judge software by the quality, not by authors age.
| pinkmuffinere wrote:
| HN isn't a judge of software; it's a place to learn and be
| curious. So people are often interested in projects that do a
| novel thing in a normal way, or a normal thing in a novel way.
| Eg, stories fascinate us because something was built by a very
| lean team, or a group with no money, or somebody who is an
| industry outsider, or a parapalegic, etc. Overcoming these
| limitations is a sort of 'hacking'.
| trollbridge wrote:
| There is a new trend in Silicon Valley of bragging about how
| young founders are, etc. along with the rather bizarre trend of
| bragging about dropping out of high school to "found a
| startup".
| rvz wrote:
| Always has been.
|
| It is a deliberate advertisement to VCs to find "the next
| Mark Zuckerberg" which the entire point is that there is only
| one.
|
| For every 1,000+ startups there is exactly only *one*
| exceptional founder.
| recursive wrote:
| It's quite remarkable that such a loosely quantified pool
| of startups (1000+) yields precisely one exceptional
| founder.
| Cyao wrote:
| Totally agree. Even if I'm a teen myself I never post my age
| unless someone asks explicitly. Saying your age is just trying
| to find excuses to justify a sub-par software imo (Not saying
| this project is sub-par)
| debo_ wrote:
| Maybe they are rightfully proud that they did this at such a
| young age?
| dang wrote:
| It's an age-old convention, a way of supporting and encouraging
| kids, and harmless.
| NaOH wrote:
| >It's an age-old convention....
|
| Bonus points for the wordplay.
| skylurk wrote:
| I am surprised you managed to get those entitlements at all!
|
| Did it help to be a non-profit?
| mohamad08 wrote:
| Tbh not at all, the process is tedious but pretty
| straightforward if you understand the requirements. Apple is
| did throw at me a huge checklist to finish which did take a
| while to complete, but after you successfully build the feature
| and submit test case videos to them its only a matter of time
| until you receive access to it. For Tap to Pay on iPhone, its
| very easy to achieve development status if you're just curious
| about the technology and its applications. Its more the
| production entitlement in which you must complete the
| specifications I mentioned before.
| sailfast wrote:
| The OP built the React Native mobile app - not the entire
| platform / company. Some folks commenting like they built the
| company. Just a point of clarification.
|
| Great work! Keep building OP!
| indigodaddy wrote:
| The OP title seems a bit misleading notwithstanding this
| caveat.
| kbar13 wrote:
| seems like this is par for course for hustler "founders"
| nowadays to say half truths to seem groundbreaking to get
| attention
| jeswin wrote:
| True. But willing to cut anyone under 21 some slack.
| Neywiny wrote:
| I think there's ambiguity. An app built for a platform that
| does xyz. Does the app do xyz, the platform, or both? If I
| build an app that takes you straight to idk a Treasury
| department website, have I built an app for a platform that
| transacts trillions of dollars?
| dang wrote:
| I thought that at first too, but then I figured it's pretty
| impressive that the app is processing $6M/month even though
| the financial platform pre-existed.
| mandeepj wrote:
| It's the same BS that people have at LinkedIn - _leading a
| $250B initiative or increased revenue by $100B_
|
| OpenAI's executive claiming - _made one of the top visited
| websites_ :-)
| rahimnathwani wrote:
| This is great!
|
| I'm curious whether you were able to build the app using backend
| APIs that were already built, or whether building this app
| created new requirements for those APIs?
| mohamad08 wrote:
| Hi! Thank you so much for your kinds work :)
|
| I actually did have to end up creating most of the backend APIs
| myself too or with the help of fellow engineers at HCB! What I
| like about HCB Mobile is that I'm not only creating a mobile
| app but also expanding our API infrastructure to allow for
| future integration with our platform.
| rahimnathwani wrote:
| Wow that's great experience.
|
| My son is 9yo and loves to make little animations in Scratch.
| He recently started to learn a bit of Python (just the syntax
| so far, no projects).
|
| I wonder whether you can share anything about your journey,
| especially if you have any tips for the stage my son is at.
| mohamad08 wrote:
| That's great to hear your son is starting at such a young
| age! From my personal experience I would recommend focusing
| more on the concepts (which Python helps with as the syntax
| is easy to navigate!). Project-based coding is my ideal way
| of learning as you build things you are truly proud of. I
| remember when I was young and made my very first Python
| turtle drawings. Once he turns 13, I highly recommend him
| join the Hack Club community. Hack Club is our parent
| organization and its dedicated mission is to help teenagers
| interested in coding. I believe I wouldn't be where I am
| today without it. It truly helped me become a better
| programmer and Hack Club even offers free prizes that help
| you learn even more such as a Raspberry Pi for those who
| submit their incredible projects :) Hope that helps! Always
| down to help if you have anymore questions
| LoganDark wrote:
| > I adopted the idea of "over the air updates" using Expo's EAS
| update service.
|
| Be careful with this. If Apple finds out for instance, your app
| will still be taken down.
| rahimnathwani wrote:
| Many developers do this, and it's explicitly allowed under
| Apple's Developer Agreement (section 3.3.1).
| Interpreted code may be downloaded to an Application but only
| so long as such code: (a) does not change the primary purpose
| of the Application by providing features or functionality that
| are inconsistent with the intended and advertised purpose of
| the Application (b) does not bypass signing, sandbox, or other
| security features of the OS; and (c) for Applications
| distributed on the App Store, does not create a store or
| storefront for other Applications.
|
| The app store review guidelines (section 2.5.1) seem more
| narrow, but I think the above is what's enforced.
| LoganDark wrote:
| Weird, because Apple took down Fortnite for enabling a direct
| buy-button (bypassing IAP) after review completed. Just
| because an offending feature wasn't enabled at the time of
| review absolutely does not mean you're in the clear to turn
| it on after the review is complete. Whereas before you'd get
| the opportunity to fix anything like that during the review
| process, by sidestepping the review process you'd better be
| confident you don't ever ship anything that wouldn't pass.
| DANmode wrote:
| Not that weird, because they were shiving each other in
| federal court at the time.
| DANmode wrote:
| I was going to offer a similar, less-absolute warning.
| daredoes wrote:
| Was just looking at this the other day for personal reasons.
| Great work!
| mrb wrote:
| That's awesome, and impressive you were able to build that. As an
| angel investor, my first question would be: how do you deal with
| financial fraud? Like users exploiting your app for money
| laundering via donations then spending... Any system that lets
| money get in and out is eventually used as a channel by
| launderers.
| KenSF wrote:
| HCB is an amazing Rails 8 app. It is the Rails app that is
| processing $6M/month.
|
| https://github.com/hackclub/hcb
|
| Excellent work on the mobile app though I would wonder, since HCB
| runs on Hotwire, why it was not written as a Hotwire Native app
| which would leverage the existing Rails Hotwire app and not
| require a complete rewrite?
| mohamad08 wrote:
| Hotwire Native tbh wouldn't have been a bad choice at all to
| use tbh. Especially if you wanna maintain 1:1 parity with the
| website. It combines both being a "web app" and native features
| we could still use like Tap to Pay and Push Provisioning. The
| downsides of it is that it isn't a cross platform framework
| like React so all changes would have to be pushed to both an
| iOS app repo and an Android app repo. Another downside is that
| it isn't a "write once run anywhere" type application as you're
| integrating Hotwire into the native code so you have to be
| comfortable with both Kotlin and Swift (however if you're
| writing native modules in React Native same applies).
|
| Both are 2 completely valid and separate paths you could take
| when building an app and I'd actually be curious what'd HCB
| Mobile look like if we did use Hotwire Native.
| cirrus3 wrote:
| What is this page of transactions for?
| https://hcb.hackclub.com/hq/transactions
|
| I get that you want to be "open", but is everyone involved in
| these transactions ok with them being shared? Even if they are,
| this doesn't seem like a good idea security wise. I see partial
| account numbers and other IDs/numbers that I assume you'd prefer
| not be public, regardless of how insensitive they may seem now.
|
| EXPENSIFY, INC. VALIDATION XXXXXX5987 THE HACK FOUNDATION +$0.89
|
| FRONTING $10,000 TO CHRIS WALKER FOR GITHUB GRANTS MADE FROM
| PERSONAL ACCOUNT -$10,000.00
|
| CHECK TO LACHLAN CAMPBELL +$800.00
|
| Transfer to Emma's Earnings -$1,923.08
| galaxy_gas wrote:
| Please look at this @mohamad08
|
| The numbers and amounts used for account validations and adding
| it to be able to pull or push money . Should not be shown
| public..
| luke-stanley wrote:
| They have this page for reporting:
| https://github.com/hackclub/hcb/blob/main/SECURITY.md
| yangikan wrote:
| Not just for hack club - but transactions for another
| organization that is using their software is public.
| https://hcb.hackclub.com/reboot/transactions?page=13
|
| Not sure if all the organizations using their software know
| this.
| garyhtou wrote:
| Hi @cirrus3,
|
| You've found an optional feature called Transparency Mode!
|
| I admit, this is A LOT of information being made accessible. We
| at Hack Club (the nonprofit organization behind HCB, and the
| owner of the transactions above) have chosen to make our
| finances publicly available on the internet. You can read more
| about it here: https://blog.hcb.hackclub.com/posts/transparent-
| finances-opt...
|
| That link (https://hcb.hackclub.com/hq/transactions) shows our
| donations and spending down to the cent since we believe donors
| deserve to know what their contributions are funding. As a
| nonprofit, you can talk about what you're spending money on,
| but transparency in every transaction builds trust for
| supporters. This level of transparency is definitely atypical,
| and I can see why it may raise concerns.
|
| Other organizations using HCB (such as Reboot) can choose to
| enable this feature too (it's off by default), and they're
| briefed on the potential risks and level of exposure to decide
| whether it's right for their organization/team. HCB supports
| 6.5k nonprofits, and roughly 64% of organizations have chosen
| to enable this feature.
|
| > I see partial account numbers and other IDs/numbers that I
| assume you'd prefer not be public, regardless of how
| insensitive they may seem now.
|
| > EXPENSIFY, INC. VALIDATION XXXXXX5987 THE HACK FOUNDATION
| +$0.89
|
| Good catch! Thanks for flagging that verification deposit. I've
| pushed a fix here: https://github.com/hackclub/hcb/pull/12336
|
| As for the account numbers (e.g. XXXXXX5987) visible in some
| transactions, these are our own defunct operating accounts, and
| we're aware they're out there on the internet. We have a new
| way of managing account numbers via Column.com, so these older
| transactions are less of a concern for me.
|
| I very much appreciate you bringing these to my attention!
| We're always looking to improve, so I'd love to hear if you
| find anything else.
| arschficknigger wrote:
| It's a hack job...
| brahbrahbat wrote:
| This is very helpful to the community. Great work.
| throwaway5465 wrote:
| In accounting, finance, M stands for 'mille' aka 'thousand'. So
| the headline reads $6000/month.
|
| Given how famed HN is for its pedantry I thought you may find
| this useful as sooner or later someone in your industry might
| make a judgement on it.
|
| MM is million, BTW.
| airstrike wrote:
| Hardly. I was an M&A banker for a decade in New York and we
| used `M` for millions across the board. A few people would use
| `MM` but on every deck I signed off we used `M` for millions,
| `B` for billions
|
| Some people do use `MM` but it's far from a standard.
| DANmode wrote:
| Mostly Europeans.
| esafak wrote:
| I think being programmers we'd expect K and M. Save the mm for
| your financial report.
| enronmusk wrote:
| Humanity has moved on from roman numerals 1000+ years ago. Talk
| about tech debt.
|
| > In accounting
|
| Only in America.
| efilife wrote:
| america is not the entire world
|
| also a simple google search disproves what you are saying. M is
| correct
| ImPostingOnHN wrote:
| America largely uses K,M,B
|
| Either OP is incorrect, or not American
| supportengineer wrote:
| Imagine all of the well connected and wealthy parents behind the
| scenes that enable this to happen.
|
| The average person like you or me would never get the approvals
| rammed through at Google.
| mohamad08 wrote:
| My parents nor did any parent step in to help me on this
| application or the approval processes. Furthermore, the
| approvals didn't get "rammed through". It took me quite a bit
| to actually acquire their entitlements and app review approval.
| I dislike when people assume just because I live in "Silicon
| Valley" I automatically have everything handed to me. If you
| would like to learn more about how the processes that I took to
| achieve this feel free to ask!
| DANmode wrote:
| I would - as an admirer.
| nxor wrote:
| Proximity to some of the country's best high schools,
| universities, and the people who work there, as well as some
| of the most unique industries in the country, could have
| played a role. In other places, if not most, people don't
| even know these things exist. Everyone has the internet,
| sure, and anyone from anywhere can learn about anything, but
| it's hard to compete with people who encountered useful/the
| right information early in life.
| dang wrote:
| Please don't be cynical on HN. It's not what this site is for,
| and destroys what it is for.
|
| https://news.ycombinator.com/newsguidelines.html
| nxor wrote:
| It's not cynical, and even if it doesn't apply here, the
| truth is it's frequently the case. I agree it's wrong to
| generalize and to oversimplify but it's also wrong to ignore
| the role that wealth and proximity to information play in a
| person's life. (Again, not saying that's the case here. The
| title is asking for this discussion. And frankly why can't
| people express this view?)
| VoidWhisperer wrote:
| No offense to the OP (what you did is great - as someone who had
| to pick up expo/RN on the fly for my newest job, it can be a bit
| annoying, and that is before all of the compliance nightmares
| associated with push provisioning) but the title does seem a bit
| disingenuous - it is phrased to make it sound like the app he
| built specifically is processing $6M/Month, where it is actually
| the platform that the app was built for that is
| nxor wrote:
| It doesn't "seem," it "is."
| necovek wrote:
| For something in the financial space, I don't see much (or
| really, any) tests in the code repository. CI also only has
| ESlint and prettier running.
|
| How are you ensuring the application will remain maintainable in
| the future, you are not breaking existing stuff and integration
| with the actual platform is always up-to-date?
|
| In short, what's the testing strategy for something that claims
| to deal with $6M a month?
|
| If there is none, you likely want to read up a bit on things like
| Testing Pyramid, automated test strategies (unit-, integration-
| and end-to-end testing).
| whynotmaybe wrote:
| Thanks, you just made me realise that I can have OTA update for
| my app and could deliver more frequently without the play/store
| hassle!
___________________________________________________________________
(page generated 2025-12-06 23:02 UTC)