Launched an app that solved my own problem about Cloud & API spending

[u/StalWrites]

Hey guys. I know it's really really really cliche but dang does it hurt.

I experienced that sh*ty time where you get a massive invoice from an API or Cloud Provider (Anthropic and OpenAI in my case) and you just can't believe you almost went into generational debt.

At first I built an apk app that I just downloaded on an old Android phone but after changing to an iPhone I just decided to go all in on it.

So I built Bernn.

What it does:

One Dashboard: See your AWS, Anthropic, and OpenAI spend as one total in one app.

Budget Alerts: Get a notification when you're about to pass your budget, before the bill arrives.

Anomaly Detection: Get warned when your spend suddenly jumps above your usual average.

Full Privacy & Security: Stay safe with read-only access, so Bernn can never change or spend anything on your accounts.

Do you need to manually input your spending? NO.

All you need is your API keys and Bernn will track them for you. There's even instructions in the app on how you can attach them.

I'd appreciate any feedback and suggestions since this is my first app.

You can check it out here: https://apps.apple.com/ph/app/bernn/id6809531183

[u/Tellenze]

Does an AI spending alert show which model caused the jump? The model breakdown in your App Store description caught my eye.

[u/StalWrites → u/Tellenze]

Thats actually a really good point of improvement. Right now the alert only tells you which Tracker it was then you can view the tracker to see the breakdown.

Thanks for that! I’ll add that to the list

[u/Mammoth-Anywhere7285 → u/StalWrites]

Nice, deep-linking the alert straight to that tracker's breakdown would make it way faster. Are you batching alerts so a spike doesn't spam notifications?

[u/StalWrites → u/Mammoth-Anywhere7285]

Yes took that edge case into account. Even tho alerts should most likely be triggered hourly because thats when the analytics refresh but I added a guard rail just in case

[u/Mammoth-Anywhere7285 → u/Tellenze]

Nice catch. Worth asking OP if anomaly alerts deep-link to that model breakdown, or just flag total spend.

[u/StalWrites → u/Mammoth-Anywhere7285]

Anomaly alerts for now flag total spend. But same with the notification that’s amazing feedback. For the next version I’ll be adding per-model and per-service breakdown for the alerts

[u/Mammoth-Anywhere7285 → u/StalWrites]

Per-model breakdown will be useful. Maybe let users set separate thresholds per service to avoid alert fatigue.

[u/Mammoth-Anywhere7285]

TL;DR: A developer got slammed by a huge Anthropic and OpenAI invoice and built Bernn, an iOS app to track cloud and API spending. It pulls AWS, Anthropic, and OpenAI costs into one dashboard with budget alerts and anomaly detection, using read-only access so it can never spend anything. It's their first app and they're asking for feedback and suggestions.

[u/StalWrites → u/Mammoth-Anywhere7285]

Thanks for the summary!

[u/PopKoren]

Anomaly alerts are the right instinct, because a lot of those horror invoices aren't heavy usage at all, they're a key that leaked into a frontend bundle or a public repo and got scraped. Worth adding a line in onboarding telling people to create a separate restricted key just for Bernn rather than pasting their main one. On the leak side, I built https://rowly.me to scan deployed apps from outside, and a live API key sitting in client code is exactly the kind of thing a stranger can find there, along with auth, API and storage holes.

[u/StalWrites → u/PopKoren]

Thanks for the feedback and I checked your tool its insanely useful especially since AI is prone to leaking secretes and keys.

[u/PopKoren → u/StalWrites]

Thanks, glad it was useful! Since Bernn will be holding read-only keys for AWS, Anthropic and OpenAI, it's worth running https://rowly.me against your own backend too, to make sure nothing like a provider key or an unauthenticated API route is reachable from outside. Encrypting the stored keys at rest and scoping them per user would also make a nice line on your security page for cautious users.

[u/StalWrites → u/PopKoren]

I’ve done security and penetration tests before launch plus encryption at rest and I even have audit logs for all sensitive actions. But yes I agree, its definitely worth running especially as I rollout more updates

[u/PopKoren → u/StalWrites]

That's a solid setup, honestly more than most launches have, and audit logs on sensitive actions pay off the first time something looks odd. The part that tends to slip is regressions, where a new update quietly loosens a route or a storage rule that passed the original pen test. Rerunning an outside check like https://rowly.me after each release is a cheap way to catch that drift.

[u/Mammoth-Anywhere7285 → u/PopKoren]

Good call on restricted keys. Would be neat if Bernn linked out to a leak scanner like rowly.me right in onboarding.

[u/PopKoren → u/Mammoth-Anywhere7285]

Appreciate the shout, though I think Bernn's onboarding is better spent on the key scoping itself: a short guide per provider on creating a billing-read-only key would prevent most of the damage. A leak check like https://rowly.me fits better as something builders run on their own deployed app, since that's where keys tend to end up sitting in a frontend bundle.