linuz90/claude-telegram-bot: source audit, 2026-10-10
Read from the source at commit b134312207e5; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Will not start without an allowlist, but Claude Code runs on the host with all permission prompts bypassed, hardcoded, and the working directory defaults to your home folder.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves nobody until you list your Telegram ID | src/handlers/text.ts:32 — if (!isAuthorized(userId, ALLOWED_USERS)) reply Unauthorized |
| With no allowlist set | env TELEGRAM_ALLOWED_USERS (empty = process exits at startup) | src/config.ts:235-239 — TELEGRAM_ALLOWED_USERS environment variable is required; process.exit(1) |
| Before the agent acts | runs the agent with permission prompts switched off | src/session.ts:223-224 — permissionMode: "bypassPermissions", allowDangerouslySkipPermissions: true; cwd defaults to HOME (src/config.ts:45) |
| Bot token | Read from the environment or a config file; no real token is committed | |