overwirehq/claude-code-telegram: source audit, 2026-10-10
Read from the source at commit 164afc1b9d3c; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
If you leave ALLOWED_USERS empty and do not set ENVIRONMENT=production, anyone who finds the bot can drive Claude on your host; the shipped .env.example itself sets ENVIRONMENT=development. Tool calls are not approved by a person by default; they are checked against APPROVED_DIRECTORY.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves anyone who finds the bot unless you set an allowlist | src/main.py:111-112 — if config.allowed_users: providers.append(WhitelistAuthProvider(config.allowed_users)) |
| With no allowlist set | ALLOWED_USERS (default none). ENVIRONMENT defaults to development, which forces development mode, so an empty allowlist allows everyone; only ENVIRONMENT=production makes startup fail | src/main.py:120-127 — if not providers and config.development_mode: ... WhitelistAuthProvider([], allow_all_dev=True); src/config/loader.py:42 — env = env or os.getenv("ENVIRONMENT", "development"); src/config/environments.py:10 — development_mode: bool = True |
| Before the agent acts | no approval step, but the agent is kept to one directory | src/config/settings.py:69-70 — interactive_tool_approval default False; src/claude/sdk_integration.py:308-366 — tool calls outside the approved directory are denied; settings.py:178 — sandbox_enabled default True |
| Bot token | Read from the environment or a config file; no real token is committed | |