Pentest engineer for Telegram bots

Budget: 25000 EUR Deadline: 7 days

In terms of format, I can conduct an audit of Telegram bots with a check of logic, API, integrations, and a final report on risks. For the basic stage, the estimate is 30,000 UAH and 5-7 working days, if we are talking about 1-2 bots without a large internal ecosystem.

My approach is to first create a map of scenarios and entry points, then check authorization, roles, webhooks, data storage, payments, or external services, if they exist. I also look at business logic separately - that's usually where the most expensive errors live, not just the classic OWASP Top 10 =)

From you, I need access to the test environment or permission for a black-box check, a description of user roles, a list of integrations, and an understanding of whether I can view the code. Am I correct in understanding that a report with risk prioritization and recommendations for developers is needed, not just a list of identified issues?

I will clarify 2 details before providing an exact estimate:
> how many Telegram bots there are and if they have an admin panel or personal account
> whether there are payments, CRM, external APIs, or sensitive personal data

Similar engineering cases from Ingello:
> https://business.ingello.com/vorfahr - automation, agents, and integration logic, closely related in terms of risks of scenarios and external APIs
> https://business.ingello.com/platforma - corporate platform with roles, processes, and complex access logic

Ingello profile for the marketplace:
> https://systems-fl.ingello.com Expand

Budget: 100 EUR Deadline: 3 days

Alexey, I will help check the Telegram bot specifically as an attack surface: the logic of scenarios, API, authorization, and integrations. I look for not only obvious bugs but also typical OWASP/API security risks — from privilege escalation to leaks through webhooks and external services. I have 7 years of experience in web services and mobile products, so I quickly identify weak points and prepare a clear report with priorities and recommendations. I am ready to discuss the details of the test.

Budget: 25 EUR Deadline: 2 days

Good day, Alexey!

I specialize in the security of Telegram bots and their APIs — I will conduct a pentest on the matter, without any fluff.

What I will check:
• Bot logic: authorization by chat_id/user_id, IDOR (access to others' data), bypassing scenarios and states, injections in commands and user input.
• API and webhooks: endpoint authentication, data leaks, lack of rate-limiting, request forgery, secrets in traffic.
• Integrations and third-party services: token security, error handling, leaks through logs and responses.
• Methodology: OWASP Top 10 and OWASP API Security Top 10.

Result: a report with vulnerabilities, their criticality by risk, and specific recommendations for remediation — clear for both developers and the business.

Timeline: 2 days for one bot (I will clarify the volume for the cluster).
Cost: 25 EUR upfront, final price based on the exact volume.

Examples of work and reviews: Freelancehunt

Ready to start immediately after access clarification. Expand

Budget: 40 EUR Deadline: 3 days

I understand the task: testing the security of Telegram bots, searching for vulnerabilities in logic, API, and integrations, and providing a report with risks and recommendations.

I will approach this from the perspective of someone who builds such bots, so I know where they usually leak: lack of verification that the update came specifically from Telegram and from the correct user, IDOR in callback_data and parameters (when someone can extract another person's data using their ID), trust in data from the update without validation, token and secret leaks in logs, injections in database queries, holes in admin commands, unprotected internal APIs that the bot accesses, and logic that can be bypassed by substituting a step in the dialogue.

Regarding the process: analyzing the attack surface of the bot and its integrations, checking against OWASP Top 10 and API security, running logic for bypass and abuse, then providing a report with risk prioritization and specific recommendations for fixes, rather than general statements.

Please let me know: how many bots there are and what they are written in, and whether they have their own backend and admin panel, or if all logic is within the bot itself? This will determine the depth of the integration checks.

Budget: 50 EUR Deadline: 2 days

Hello. I am ready to take on your order. I have experience in application security, API testing, and finding vulnerabilities in Telegram bots and web services. I have conducted checks on application logic, API integrations, authorization, user data processing, and looked for issues such as those listed in the OWASP Top 10.
For your project, I will conduct an audit of the Telegram bot: I will check for vulnerabilities in the logic, API, integrations with external services, possible bypasses of restrictions, access issues, data processing problems, etc.
After testing, I will prepare a clear report with identified risks, severity levels, and recommendations for remediation. I can even fix the issues myself.
I use tools like Burp Suite, Postman, OWASP ZAP, API analysis, and manual logic testing. I mainly test manually.
In terms of timing, approximately 2–4 days, depending on the size of the project and the number of integrations.
As for the cost, $50-80.

Budget: 150 EUR Deadline: 5 days

Good day.

I am a QA Engineer with practical experience in testing APIs, integrations, business logic, and authorization scenarios. I can assist with security testing of Telegram bots within the framework of black-box / functional security testing.

What I can check:

* the logic of the Telegram bot and the possibility of bypassing expected scenarios;
* authorization and access to features;
* API requests, integrations, and error handling;
* validation of input data;
* potential risks related to OWASP Top 10 and API security;
* incorrect handling of roles, IDs, user states, and edge cases.

Based on the results, I will prepare a clear report describing the identified issues, reproduction steps, risk level, and recommendations for fixes.

Before starting, I would like to clarify the available scope of testing: will it only be the Telegram bot, or will there also be API documentation, test accounts, logs, or a test environment?

I am ready to discuss the details. Expand

Budget: 25 EUR Deadline: 1 day

Hello, Alexey!

I specialize in the security of Telegram bots and their APIs — I will conduct a pentest on the matter, without any fluff.

What I will check:
• Bot logic: authorization by chat_id/user_id, IDOR (access to others' data), bypassing scenarios and states, injections in commands and user input.
• API and webhooks: endpoint authentication, data leaks, lack of rate-limit, request forgery, secrets in traffic.
• Integrations and third-party services: token security, error handling, leaks through logs and responses.
• Methodology: OWASP Top 10 and OWASP API Security Top 10.

Budget: 25 EUR Deadline: 3 days

Hello!

I am interested in the task of testing the security of Telegram bots. I possess the necessary skill set to conduct a quality analysis and find vulnerabilities.

Why I am suitable for this task:

Deep understanding of architecture: I actively work with APIs and network protocols, which allows me to see vulnerabilities at the implementation level (logic, improper input handling, insecure APIs).

Technical background: I have experience in development with Python/Java/C++, which helps me quickly analyze the bot's source code and find hidden bugs in the logic that are not accessible during regular "black box" testing.

Methodology: In my work, I rely on OWASP Top 10 standards and the specifics of API protection.

What I am ready to do right now:

Attack surface analysis: Checking endpoints and interactions with the Telegram Bot API.

Finding logical vulnerabilities: Checking for bypassing restrictions, manipulating the bot's state, and data leaks.

Reporting: I will provide a detailed report that will include not only the found vulnerabilities but also specific recommendations for their remediation (with code examples, if necessary).

I am ready to start working on the task immediately after discussing the details. Please let me know if there is access to the bot's source code or if testing needs to be conducted using the "black box" method?

I would be happy to help ensure the security of your product.

Best regards,
Yaroslav Expand

Budget: 30 EUR Deadline: 1 day

Good day, Alexey!

I see you have also posted a project on load testing — I am ready to take both on a turnkey basis, as they logically complement each other.

Regarding the pentest:

I will check for typical vulnerabilities in Telegram bots:

IDOR via chat_id / user_id — unauthorized access to others' data
Injection in user inputs (SQL, command injection)
Leakage of bot token / webhook URL
Webhook security (SSL, secret token, replay attacks)
Bypassing authorization and privilege escalation
API security — rate limiting, data leakage in responses
Result: a report detailing vulnerabilities, severity level (CVSS), and specific recommendations for remediation.

Deadline: 3 days
Cost: please specify the budget — competitors in your project have set unrealistic amounts, I will propose a reasonable price.

Please clarify: is the bot on webhook or polling, are there any external integrations? Expand

Budget: 12345 EUR Deadline: 3 days

Hello. Does the bot use external APIs or third-party services for data processing?

I will clarify the details regarding deadlines and budget in personal correspondence.

Here’s how I will execute this project:
1. I will conduct a manual and automated analysis of the bot's logic and its commands.
2. I will test the API endpoints and integrations for data leaks and injections.
3. I will compile a report describing the identified risks, their criticality, and specific recommendations.

Thank you for considering my proposal. I look forward to the opportunity to collaborate with you!

Budget: 15000 EUR Deadline: 7 days

Good day! We have experience in conducting pentests for bots and integrations. We implement checks through API analysis, search for logical vulnerabilities, and assess risks according to OWASP. We will provide a detailed report with practical recommendations for addressing identified threats. We are ready to start the security audit of your project in the near future.