trade-karne
Warn
Audited by Socket on Jul 24, 2026
1 alert found:
SecuritySecuritybot/telegram_ctl.py
MEDIUMSecurityMEDIUM
bot/telegram_ctl.py
No clear evidence of overt malware (no obfuscation, no eval/exec, no persistence/backdoor patterns) is present in this fragment. However, it implements a high-impact remote control surface: Telegram commands from a specified chat_id can pause/resume risk management and trigger broker.sell() across all positions (/close_all), and it can exfiltrate account/trading details and the last 10 log lines to Telegram. This should be treated as a significant operational security risk requiring strict authorization and token/chat_id protection.
Confidence: 66%Severity: 70%
Audit Metadata