duckbugio/flock: source audit, 2026-10-10
Read from the source at commit 19c82ddb4432; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Fails closed: with ALLOWED_USERS empty nobody is served. The default Claude backend runs with permissions bypassed; the containment is the Docker container the project expects you to deploy it in.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves nobody until you list your Telegram ID | cmd/flock-telegram/main.go:516-518 — if !cfg.IsAllowed(msg.From.ID) { ... return } |
| With no allowlist set | ALLOWED_USERS (default empty); an empty list serves nobody | internal/config/config.go:903-904 — IsAllowed returns containsID(c.AllowedUsers, userID), no empty-list bypass |
| Before the agent acts | runs the agent with permission prompts switched off | core/claude/runner.go:152-156 — permissionMode := "bypassPermissions" |
| Bot token | Read from the environment or a config file; no real token is committed | |