Safety
Keep access secrets safe
Recognize sensitive access data, understand how the app protects it, and know what to do if you suspect a leak.
Any data that allows sign-in, API calls, or sender impersonation is a secret. Do not include it in screenshots, exports, custom logs, or material you send to support.
What you need to protect
| Secret | Access it may grant |
|---|---|
| Telegram session | Access to a signed-in account. |
| Sign-in code, two-step verification password | Complete sign-in or confirm a sensitive action. |
| Proxy password | Use the proxy's network route. |
| Hetzner API token | Manage resources within the token's granted permissions. |
API key beginning with tga_ |
Call the API within an AI connection's scope. |
| Webhook secret | Sign webhooks or verify their authenticity. |
| Bot token | Control the corresponding bot. |
| Machine pairing code | Pair a worker with a registered machine. |
Do not share a full proxy configuration string if it contains a username and password. A sign-in QR image must also be treated as sensitive access data.
How the app protects secrets
The app seals secrets that it needs to decrypt for use, such as proxy passwords, Hetzner tokens, bot tokens, and webhook secrets. Telegram sessions are protected on the worker machine and during backup.
AI connection API keys are stored differently: the app keeps a hash to verify the key, not a plaintext copy you can view again. If you lose a key, you need to create a replacement.
A two-step verification password is entered for one sign-in or action that requires it. It is not a password to save in the account profile. Do not put it in a notes field “for next time.”
Webhook secrets are returned when created or rotated, with a shown_once indicator. A repeated call with the same idempotency key may return the original creation result. “Shown once” should therefore not be taken to mean that the secret never passes through an API response.
Normal exports and diagnostics are not secret backups. The app redacts some sensitive patterns in webhook responses, but you must still review files and content before sharing them. The redactor cannot guarantee that it will recognize every secret string you paste in.
If an API key is exposed
- Go to Settings → AI connections.
- Select Stop now for the affected connection.
- Review its activity and the jobs it created.
- Rotate the API key.
- Update the key in systems authorized to use it.
- Reactivate the connection only after removing the cause of the leak.
Stopping a connection rejects new commands and cancels its queued jobs. Actions already performed on Telegram are not undone by stopping the connection.
If you no longer use the connection, delete it after saving investigation details that contain no secrets.
For other secrets
Rotate the webhook secret, then update the receiver. If you revoke the old key immediately, receivers that have not updated will reject events. For Hetzner tokens, bot tokens, or proxy passwords, revoke or rotate them at the issuing service, then update the relevant configuration.
If you suspect a Telegram session has been exposed, review signed-in sessions and revoke any you do not recognize. Do not send a session to support so they can “check it for you.”