yym68686/ChatGPT-Telegram-Bot: source audit, 2026-10-10
Read from the source at commit cf2430d98b04; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
With no whitelist set, anyone who finds the bot can chat on your API key, and with no ADMIN_LIST anyone can open /info and change the bot's settings. Set both before deploying.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves anyone who finds the bot unless you set an allowlist | utils/decorators.py:30 — if config.whitelist and ... not in config.whitelist |
| With no allowlist set | env whitelist (unset = everyone); ADMIN_LIST unset = everyone is admin | config.py:392 — whitelist = os.environ.get('whitelist', None); utils/decorators.py:28 — if config.whitelist == None ... return await func(...) |
| What it can do | Chat only | README.md:87 — code interpreter plugin, default False (plugin code is in a submodule not in the clone) |
| Bot token | Read from the environment or a config file; no real token is committed | |