Will It Vibe?Telegram bot token
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Telegram bot token (<id>:AA...) was found. It fully controls the bot: reading updates and sending messages as it.
Why it matters
A Telegram bot token fully controls the bot: reading incoming updates and sending messages as it. A leak lets an attacker hijack the bot to spam or phish its users. The token is long-lived until regenerated.
How to fix it
Move the token into an environment variable and read it at runtime. Regenerate the token with BotFather after removing it, which invalidates the old one. Keep it off any client-side code.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo