tbxark/ChatGPT-Telegram-Workers: source audit, 2026-10-10
Read from the source at commit 0d152e567a2b; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Deny by default: only ADMIN_ID and IDs you add get answers, unless you switch on Allow All Users. Set TELEGRAM_SECRET_TOKEN too, or webhook updates are not verified.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves nobody until you list your Telegram ID | packages/lib/core/src/bot/handler/handlers.ts:112-119 — only allowedUserIds and ADMIN_ID pass; others get the not-in-the-white-list reply |
| With no allowlist set | allowAllUsers default false; allowedUserIds default []; ADMIN_ID always allowed | packages/lib/config/src/defaults.ts:18-20 — allowAllUsers: false, allowedUserIds: [], allowedGroupIds: [] |
| What it can do | Chat only | chat only, runs on Cloudflare Workers; nothing executes on a host |
| Bot token | Read from the environment or a config file; no real token is committed | |