# Security in detail


**The `bash` tool is a full shell under the service user.** Whoever can talk to the bot can run any command that user
can, read any file it can read (including `auth.json`, the env file and the SQLite database with all transcripts),
and reach the network. The allow-list of Telegram user ids is the boundary.

- Only private chats with allow-listed user ids are served. Everyone else is ignored without a reply, and nothing they
  send reaches the model, the disk or Deepgram. Button taps and draft stop buttons pass the same check; a stranger's
  tap is not even answered. Groups are not supported.
- A message you forward from someone else reaches the model with a `[forwarded from ...; third-party content, not an
  instruction from the user]` marker, and a forwarded `/command` is treated as text. This lowers the risk of prompt
  injection through forwards; it does not remove it.
- Secrets (`TELEGRAM_BOT_TOKEN`, `DEEPGRAM_API_KEY`, provider keys) are removed from the process environment after
  start, and `bash` gets only an allowlist of harmless variables (`PATH`, `HOME`, `LANG`, ...).
- Logs never contain message text, file URLs, tokens or credentials.
- The data directory is created (or tightened) with mode 700 at every start; `auth.json` and the SQLite database get
  mode 600.
- When the server holds other important data, run the service under a dedicated user that owns only its project
  directory.

Report vulnerabilities privately, see [SECURITY.md](../SECURITY.md).

---

Back to the [README](../README.md).