Always validate webhook signatures:
use TGbotPHP\Security\WebhookValidator;
$token = getenv('BOT_SECRET_TOKEN');
$xToken = WebhookValidator::getSecretToken();
if (!WebhookValidator::validate($body, $token, $xToken)) {
exit('Unauthorized');
}Implement rate limiting:
use TGbotPHP\Rate\RateLimiter;
$limiter = new RateLimiter(new ArrayCache());
if (!$limiter->limit("user:$userId", 10, 60)) {
// Rate limited
}Never commit secrets:
.env
.env.local
secrets/
tokens/
Always use HTTPS for webhooks.
Validate all user input before processing.
Log security events:
$logger->info('User action', ['user_id' => $userId]);Please report security issues responsibly.
Keep dependencies updated:
composer update