Security & webhook validation
Gategram validates webhook secrets, authenticates Mini App requests, verifies payment amounts, and does not collect buyer card details.
Webhook validation
Telegram webhook secret verification
Telegram sends a deployment-specific secret token in the webhook request header. Gategram compares it with a timing-safe check and rejects missing or incorrect values before processing an update.
initData validation
When creators interact through the Mini App, we validate Telegram’s initData payload. This confirms the user’s identity comes directly from Telegram’s authentication system, preventing impersonation.
Payment amount verification
Before confirming any pre_checkout_query, Gategram verifies the payment amount matches the product’s price in the database. This prevents manipulation of the payment amount between the invoice creation and checkout confirmation.
Data handling
Minimal data collection
Gategram stores Telegram identity fields, product and transaction records, and creator payout details when a creator supplies them. It does not request buyer phone numbers, contacts, or message history.
No payment credentials
New purchases use Telegram Stars. Gategram does not collect buyer card numbers or payment credentials. Creator payout details are stored separately for payout administration.
Content isolation
Product content (the text, links, or files creators upload) is stored separately from transaction data and delivered only to verified buyers.
Rate limiting
API endpoints are rate-limited to prevent abuse, brute force attempts, and denial of service. Excessive requests are blocked automatically.
Infrastructure
HTTPS everywhere
All communication between Telegram, Gategram, and users is encrypted with TLS.
Input validation
All user inputs are validated and sanitized before processing to prevent injection attacks.
Random product IDs
New product IDs are eight-character, non-sequential identifiers generated with cryptographic randomness. Paid content still requires verified ownership or purchase; an ID is not treated as authorization.
Dependency auditing
Dependencies are regularly audited for known vulnerabilities using automated security scanning.
Operational security runbook
Quarterly secret rotation
Rotate BOT_TOKEN, WEBHOOK_SECRET, and database auth tokens on a regular cadence or immediately after any suspected exposure.
Post-rotation validation
After every rotation, validate Mini App auth, webhook delivery, invoice creation, and successful content delivery before closing the incident/change.
Incident rollback plan
Keep a short rollback window with prior secret versions available in secure storage to reduce time-to-recovery if verification checks fail.
Questions about security?
Reach out via the bot or check the docs for technical details.