Use a dedicated Telegram reader account with only the channel access required for digests. Treat Telegram API credentials, phone numbers, auth codes, and session strings as secrets.

• Store Telegram credentials in .env or an operating-system secret store.
• Keep .env, .env.*, .sessions/, *.session, *.sqlite3, logs/, reports/, and generated artifacts out of Git.
• Do not paste session strings into issue trackers, chat, logs, or reports.

• telegram-cowork config-check prints redacted configuration only.
• telegram-cowork sync prints aggregate counts, not credentials, auth codes, phone numbers, API hashes, or session strings.
• If Telethon asks for an auth code during first login, enter it locally and do not store the code in project files.

The SQLite database may contain private channel content. Keep it local, back it up only to trusted storage, and delete it when the reader account or project is retired.