From 0dd4d3d62b0de3eec8c2d89a3a83ae26d19f7f44 Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Sat, 11 Jul 2026 13:42:51 -0700
Subject: [PATCH] fix(security): remove hardcoded bot token from webhook setup
 script

Token was committed in plaintext since the initial commit in a public
repo and was used to deface the bot profile. Script now requires
BOT_TOKEN via environment variable instead.
---
 package.json                      | 2 +-
 scripts/setup-telegram-webhook.sh | 8 +++++++-
 src/version.json                  | 6 +++---
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 6649ee6..8d86f38 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pezkuwi-telegram-miniapp",
-  "version": "1.0.236",
+  "version": "1.0.237",
   "type": "module",
   "description": "Pezkuwichain Telegram Mini App - Forum, Announcements, Rewards",
   "author": "Pezkuwichain Team",
diff --git a/scripts/setup-telegram-webhook.sh b/scripts/setup-telegram-webhook.sh
index ead8b18..5bfcbf1 100755
--- a/scripts/setup-telegram-webhook.sh
+++ b/scripts/setup-telegram-webhook.sh
@@ -2,8 +2,14 @@
 
 # PezkuwiChain Telegram Bot Webhook Setup
 # Run this script from a machine that can access Telegram API
+# Usage: BOT_TOKEN="..." ./scripts/setup-telegram-webhook.sh
+
+if [ -z "$BOT_TOKEN" ]; then
+  echo "Error: BOT_TOKEN environment variable is not set."
+  echo "Usage: BOT_TOKEN=\"<token>\" ./scripts/setup-telegram-webhook.sh"
+  exit 1
+fi
 
-BOT_TOKEN="8548408481:AAEsoyiVBllk_x0T3Jelj8N8VrUiuc9jXQw"
 WEBHOOK_URL="https://vbhftvdayqfmcgmzdxfv.supabase.co/functions/v1/telegram-bot"
 
 echo "Setting up Telegram webhook..."
diff --git a/src/version.json b/src/version.json
index 681b084..c35610d 100644
--- a/src/version.json
+++ b/src/version.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.0.236",
-  "buildTime": "2026-06-28T18:16:24.919Z",
-  "buildNumber": 1782670584920
+  "version": "1.0.237",
+  "buildTime": "2026-07-11T20:42:51.109Z",
+  "buildNumber": 1783802571110
 }