Kujaga

• 

  Telegram Bot (Kujaga)

Inspiration Indonesia lost Rp 9.1 Trillion to cybercrime last year, with 432,000+ fraud cases. Public figures — influencers, creators, entrepreneurs are prime targets for account cloning, impersonation scams, and data breaches. Yet only ~35% of Indonesian content creators have any digital protection, and enterprise security solutions cost Rp 500Juta-Rp 5Million/month completely out of reach for individual creators.

We built Kujaga "pelindung" (protector) in Sanskrit to give Indonesian public figures the same level of identity protection that enterprises have, but at a price they can afford.

What it does Kujaga is an Autonomous Identity Security Agent that works 24/7 with zero manual triggers:

Breach Detection: Monitors emails across 15B+ breach records via HIBP Brand Monitoring: Tracks name mentions across the internet via Google Alerts Phishing Block: Detects impersonating domains using Google Safe Browsing + VirusTotal PDUPA Letter Generation: AI-generated Indonesian PDP Law deletion letters via MiniMax Telegram Alerts: Real-time notifications in Indonesian 30-Day Deadline Tracker: Auto-escalates to Kominfo if no response Setup once. Kujaga protects forever.

How we built it

Architecture: OpenClaw — Self-hosted AI gateway on VPS for agent orchestration Telegram Bot (@Kujaga_bot) — Primary user-facing channel MiniMax API — Letter generation with Indonesian PDP Law context Supabase — User data, threats, documents, pg_cron for scheduled monitoring Free APIs — HIBP, Google Alerts RSS, Google News RSS, VirusTotal, WHOIS

Workflow:

1. User connects via Telegram in 2 minutes
2. Kujaga schedules 6-hour monitoring cron jobs
3. On threat detected → Generate letter → Send Telegram alert
4. User approves → Letter sent → 30-day deadline tracker starts
5. Day 25: Reminder → Day 30: Auto-escalate to Kominfo

Tech Stack: Next.js 14 (dashboard), Node.js 18 (agent), Express.js (API), Tailwind CSS

Challenges we ran into

1. OpenClaw configuration — Gateway defaults to loopback-only, had to discover correct gateway.bind lan syntax via trial and error
2. MiniMax API integration — Model configured but API key authentication required careful setup
3. Stateless vs stateful — Balancing autonomous monitoring (needs state) with stateless API design
4. Indonesian PDP Law context — Letter generation required proper legal terminology that generic LLMs don't know

Accomplishments that we're proud of ✅ Functional autonomous agent — Monitoring runs 24/7 with zero user triggers ✅ Telegram-native experience — Indonesian speakers can set up in 2 minutes via familiar interface ✅ Free tier of security tools — Leveraged HIBP k-anonymity, Google RSS, VirusTotal (free tiers) for comprehensive coverage ✅ Complete user flow — From signup to automated PDUPA letter generation working end-to-end ✅ OpenClaw Hackathon submission — Built on OpenClaw framework, leveraging its gateway, Telegram channel, and agent capabilities

What we learned

• Single agent architecture is correct — Based on Google Research paper "Towards a Science of Scaling - Agent Systems," monitoring tasks are sequential (not parallel), making single agent the optimal choice
• Personal trust model — OpenClaw's architecture is designed for single-user personal assistants, which perfectly fits Kujaga's use case
• Indonesian language AI — Generic LLMs lack Indonesian legal terminology; fine-tuning or careful prompt engineering is essential for PDUPA letters
• Telegram-first is the right call — 50-70M Indonesian users already on Telegram, making it the ideal primary channel

What's next for Kujaga

Short-term: Full Supabase database integration (users, threats, documents) Real DOKU payment integration for post-beta monetization API keys for all security services (HIBP, VirusTotal, WHOIS)

Long-term: Mobile app with deeper Telegram integration White-label for agencies/managers Multi-language support (Bahasa Indonesia + English) Partnership with Indonesian cybersecurity firms Kujaga: Once setup, protected forever.

Built With

• api
• cloud
• cursor
• doku
• supabase
• tencent
• vercel