DecentralizeHQ home

Telegram security checklist

Telegram admins get this checklist instead of an audit. You fill it in from your group’s settings and send it back, and we reply with a one-page written review with a fast turnaround. You give us no access to your group.

How does it work?

  • Fill it in from your group’s Edit screen, as the group owner or an admin.
  • Send it back to us.
  • We read your answers and send you a short written review.

We can’t check your answers from outside, so every finding is marked “owner-reported”.

What do we never ask for?

We never ask for admin rights, bot tokens, passwords, 2FA codes, seed phrases, private keys or ownership transfer. Do not send us private invite links. Counts and settings are enough.

What is in the checklist?

Answer with Yes, No, Off, or the value you see. Tap Not sure if you are not sure.

Telegram Security Checklist
Start here: open the group, tap its name, then Edit (on Android, the pencil icon). Most answers are on that screen.

1. About the group

1.1 Is the group public or private? Public groups have a short link like t.me/name that anyone can find. Private groups can only be joined with an invite link.Where: Edit > Group Type.
1.2 Is the group linked to a channel? A channel can attach a group for comments. If yours is linked, the channel’s posts appear in the group and people reply there.Where: the Edit screen. A Linked Channel line with a channel name means Yes. No line means No.
1.3 If linked: do people have to join the group before they can comment? If not, anyone reading the channel can post in your group without joining. Spam often gets in that way.Where: Edit > Group Type, under Who can send messages? Everyone (Android: the Only members toggle is off) means anyone can post without joining. Only Members (Android: toggle on) means they must join first.

2. Admins

Admins with too many rights are the biggest risk if an account gets hacked.
Where: Edit > Administrators. Tap each admin to see their rights.
Admin 1
For every admin, bots included:
their @username
person or bot
Yes or No for:
Change Group Info
Delete Messages
Ban Users
Invite Users via Link
Add New Admins
Remain Anonymous

3. Bots

Bots can delete messages and post links, so we check that each one is real and still needed.
Where: tap the group name and look at the member list. Bots show a line about access to messages under their name.
Bot 1
For every bot:
its exact @username (lookalike scam bots exist, so spelling matters)
what it does (for example CAPTCHA for new members, spam filter, welcome messages)
admin Yes or No

4. What ordinary members can do

These are the rights scammers use most when every member has them.
Where: Edit > Permissions. Tap Send Media to open its list.
Yes or No:
Add Members (Android: Add Users)
Pin Messages
Change Group Info (Android: Change Chat Info)
Send Files (Android: Files, under Send Media)
Embed Links (under Send Media)

5. Spam controls

5.1 Slow Mode: Off, or the time it’s set to.Where: Edit > Permissions, under Slow Mode.
5.2 Aggressive Anti-Spam: On, Off, or Not shown.Where: Edit > Administrators, at the top. It only appears in larger groups, so “Not shown” is a normal answer.
5.3 Hide Members: On or Off. When the member list is visible, scammers can copy it and DM your members.Where: Edit > Members, at the top.

6. Invite links

Old links that never expire are how unwanted people keep getting in.
Where: Edit > Invite Links. The first link is permanent. Any extra links are listed below it. Tap one to see its settings.
Do not paste private invite links here. Counts and settings are enough.
6.1 How many extra links are there?
6.2 For each extra link:
Link 1
Expires (the date, or Never)
Join limit (the number, or Unlimited)
Request Admin Approval (Android: Approve New Members) On or Off

7. Recent Actions

This is the group’s log of the last 48 hours. A new admin you didn’t expect is a common sign of a takeover.
Where: Edit > Recent Actions.
7.1 Was any admin added, removed or given new rights? If yes, who did it and to whom.
7.2 Was any group setting changed that you didn’t expect? If yes, what changed.

How do I send it back?

Add your email and project name, then tap Send my answers.
Your answers stay in this browser until you tap Send. Then they go through Web3Forms to our email inbox. No cookies. Privacy