Wallos is a self-hosted PHP web application for tracking personal subscriptions, payments, and budgets. It provides a full CRUD interface for subscriptions with categories, currencies, payment methods, and household members. The backend is PHP 8.3 with SQLite, served via Nginx and PHP-FPM in a Docker container. It supports multi-user accounts, OIDC/OAuth login, TOTP two-factor authentication, and email/password reset flows. The application includes a rich set of notification channels (email, Discord, Telegram, Pushover, Gotify, ntfy, Web Push, webhooks, and more) triggered by cron jobs for upcoming payments and cancellations. A statistics dashboard aggregates costs, trends, and budget comparisons. The codebase is organized as a flat PHP application without a framework, using custom includes for shared logic and a simple API layer for external access. The architecture follows a page-based pattern where each PHP file serves as a route, with AJAX endpoints under `/endpoints/` for dynamic actions. The application demonstrates attention to security with CSRF tokens, prepared statements for all SQL queries, input validation, and a centralized SSRF protection module for outbound HTTP requests. A notable feature is the Web Push notification implementation that follows RFC 8290-8292 using VAPID and ECDH encryption. The currency conversion system uses a WeakMap-based cache per request to avoid repeated API calls. The codebase is actively maintained with frequent releases and a comprehensive migration system. However, the code exhibits significant repetition across notification channels and logo handling, with many nearly identical endpoint files. The i18n system is manually maintained across 20+ languages, leading to potential drift. The application lacks a formal testing framework beyond a custom test harness that checks security regressions and data integrity. The absence of a Composer dependency manager and reliance on vendored libraries (PHPMailer, Parsedown) adds maintenance overhead. Overall, Wallos is a functional, feature-rich self-hosted application with some well-crafted security components but suffers from code duplication and boilerplate typical of PHP applications without a framework.