NachoSEO/claudegram: source audit, 2026-10-10
Read from the source at commit 7e37501654ad; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Only your listed user IDs can use it and it refuses to start without them. Nothing is sent to Telegram for approval: edits are auto-accepted and Bash is pre-approved, and the working directory defaults to your home folder.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves nobody until you list your Telegram ID | src/bot/middleware/auth.middleware.ts:45-48 — if (!config.ALLOWED_USER_IDS.includes(userId)) reply not authorized |
| With no allowlist set | ALLOWED_USER_IDS (required; validation fails and the process exits without it) | src/config.ts:15-17 — ALLOWED_USER_IDS: z.string().min(1, 'At least one allowed user ID is required') |
| Before the agent acts | runs the agent with permission prompts switched off | src/claude/agent.ts:271-282 — acceptEdits by default; :362-364 — allowedTools includes Bash; no approval prompt is sent to Telegram |
| Bot token | Read from the environment or a config file; no real token is committed | |