father-bot/chatgpt_telegram_bot: source audit, 2026-10-10
Read from the source at commit 3631d6534f2c; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Out of the box anyone who finds the bot can chat on your API bill; fill allowed_telegram_usernames before going live, preferring numeric IDs. It cannot run code on the host.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves anyone who finds the bot unless you set an allowlist | bot/bot.py:849-855 — user_filter = filters.ALL; if len(config.allowed_telegram_usernames) > 0: restrict |
| With no allowlist set | allowed_telegram_usernames in config/config.yml; the example default is [] = anyone | config/config.example.yml:6 — allowed_telegram_usernames: [] # if empty, the bot is available to anyone. |
| What it can do | Chat only | chat only: no subprocess or tool calling |
| Bot token | Read from the environment or a config file; no real token is committed | |