Project

General

Profile

Actions
Copy link

Task #6126

open

SECURITY: live Telegram bot token committed in workflow scripts — revoke and move to env

Added by Redmine Admin about 9 hours ago. Updated about 9 hours ago.

Status:
Feedback
Priority:
Immediate
Assignee:
-
Start date:
08/26/2026
Due date:
% Done:

50%

Estimated time:

Description

Found while reviewing the stats daemon (parent epic #6116).

Problem

A live Telegram bot token is hardcoded in the repository, in the notification curl calls:

  • scripts/workflow/update_stats.sh — appears in every api.telegram.org/bot<token>/sendMessage url in the loop (10 occurrences)
  • sdlc/0-vibes/raw/2026-08-26/slow_ daemon.md — the pasted copy of the daemon carries the same token

The target chat id is hardcoded alongside it.

Anyone with repository access — and anyone who ever had it, since it is in git history — can post as this bot, read what it can read, and change its webhook.

Actions

  1. Revoke the token via @BotFather (/revoke) and issue a new one. Do this first; everything below is cleanup that does not help until the old token is dead.
  2. Move the new token and the chat id into environment variables (e.g. TELEGRAM_NOTIFY_TOKEN, TELEGRAM_NOTIFY_CHAT_ID) read by the scripts, supplied by the deployment environment.
  3. Redact the token in the vibes file — it is a raw capture and stays in the pipeline, so replace the value with a placeholder rather than deleting the file.
  4. Decide whether to purge git history. Given the token will already be revoked, this is optional and disruptive; note the decision either way.

Also in the same sweep

scripts/workflow/download_trading_point_inspections.sh contains a line of accidental keyboard input committed into a comment (#./jdk-21.0.1/bino8i7a SDFGTYHUIO90PQ …). Harmless but should be cleaned up while the scripts are being touched.

Actions
Copy link

Also available in: Atom PDF