mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 16:31:09 +00:00
Satoshi Qazi Muhammed
146b3a5bfd
The KRD bot's "Create Wallet" button generated a 12-word seed inside the edge function and sent it to the user as a chat message. Every new wallet's seed therefore passed through this server, and stayed in Telegram's cloud history on every device the account is signed in on: whoever gets into the server, a log, or the Telegram account gets the wallet. The button now opens the mini app at ?page=wallet, which lands on the wallet section; that section already creates the seed on the device (src/lib/wallet-service.ts) and never sends it anywhere. The create_wallet callback stays for buttons on old welcome messages, and answers with the same mini app link instead of a seed. With nothing left to derive, the bot no longer imports the keyring, util-crypto or bip39.