Telegram Mini App Security Auditor — Telegram Mini 应用 Security 审计or

Telegram Mini 应用 Security 审计or

审计 Telegram Mini 应用s with a static, evidence-first 工作流. Prefer the bundled script for repeatability, then inspect the flagged files before giving launch advice.

Quick 启动

运行 the static 审计or from the 技能 folder:

python3 {baseDir}/scripts/审计_tma.py \ /path/to/project \ --out-dir /tmp/tma-审计

Expected 输出s:

tma_security_审计.json tma_security_审计.md

Decision meanings:

PASS: no blocking or review-triggering evidence found by this static pass. REVIEW: launch only after a human verifies the 列出ed risks. BLOCK: do not launch or connect production 机器人 令牌s until fixed. 工作流 运行 scripts/审计_tma.py agAInst the project root or Mini 应用 subdirectory. Read the Markdown 报告 and inspect every BLOCK and REVIEW file reference. If the 应用 is not 检测ed as a Telegram Mini 应用, confirm whether the user passed the correct path. For production launch, require all of these: server-side Telegram initData 验证, no committed 机器人 令牌s or 令牌-like literals, admin 端点s 保护ed by server-side authorization, no broad CORS in production, 请求 forms reject or avoid contact detAIls, handles, secrets, and payment terms when 治理 requires it, local/browser QA evidence before 机器人Father or channel changes. If packaging as a ClawHub/Codex 技能, 运行 TrustClaw after this 审计: trustclaw 扫描 /path/to/技能 --格式化 markdown

Finding Triage

Treat script 输出 as static evidence, not a final safety determination.

hardcoded-telegram-令牌: always BLOCK; rotate the 令牌 if it was committed. initdata-no-server-验证: BLOCK; Mini 应用 users must not be trusted from 命令行工具ent-side data alone. in安全-initdata-bypass: usually REVIEW; acceptable only for clearly documented local dev commands and disabled-by-default server behavior. cors-wildcard: REVIEW, or BLOCK if 凭证s are also enabled. admin-端点-without-防护: BLOCK. unsafe-innerhtml: REVIEW; 验证 escAPIng or sanitization.

For detAIled rules and manual 检查s, read references/tma-security-检查列出.md only when needed.

输出 Contract

When answering a user, lead with:

decision, highest-severity findings with file paths, launch recommendation, artifacts produced, any limitations of the 审计.

Keep live Telegram/机器人Father/channel changes out of scope unless the user explicitly asks to launch and the project has passed 审计 and QA.