godagoo/claude-telegram-relay: source audit, 2026-10-10
Read from the source at commit 563220c2ccf5; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
If you forget TELEGRAM_USER_ID, the bot starts anyway and passes anyone's messages to Claude on your machine. Its .env.example lists the variable as required, but the code treats it as optional.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves anyone who finds the bot unless you set an allowlist | src/relay.ts:173 — if (ALLOWED_USER_ID && userId !== ALLOWED_USER_ID) reply "This bot is private." |
| With no allowlist set | env TELEGRAM_USER_ID, default empty; when empty every sender is served | src/relay.ts:29 — ALLOWED_USER_ID = process.env.TELEGRAM_USER_ID || ""; src/relay.ts:486 — Authorized user: ANY (not recommended) |
| Before the agent acts | what the agent may do depends on your own Claude Code settings | src/relay.ts:190-205 — claude -p with no permission flag; what Claude may do depends on the host's own Claude Code settings |
| Bot token | Read from the environment or a config file; no real token is committed | |