Bots

Telegram bots feel deceptively safe. A lot of developers assume the chat interface somehow neutralizes frontend risk. It doesn’t. The bot itself may only send messages, but the moment you render Telegram-controlled content inside a browser, an admin dashboard, a support console, or a Telegram Web App, you’re back in classic XSS territory. I’ve seen this pattern more than once: the bot is harmless, the backend is simple, and then someone builds a quick “internal” moderation UI that injects chat messages into innerHTML. That internal tool becomes the easiest path to account takeover. ...

Discord bots themselves do not execute browser JavaScript inside Discord messages, and that lulls a lot of developers into the wrong threat model. I’ve seen this play out the same way over and over: someone builds a bot, then adds a web dashboard, moderation panel, transcript viewer, ticket system, or message log page. The bot becomes the source of untrusted content, and the browser-facing parts become the XSS sink. That distinction matters. The bug usually is not “Discord has XSS.” The bug is “my bot collected hostile input from Discord and I rendered it into HTML like an idiot.” ...