Validate bot token before enabling plugin
- Invalid tokens trigger repeated `404 Not Found` restart loops.
- Disable Telegram plugin until a valid token is supplied.
- Log token validation failures clearly in support-visible logs.
Make pairing explicit in your UI
- Show pairing code and pass it to your backend pairing endpoint.
- Return command output back to the UI so users know what succeeded.
- If approval is pending, surface a non-fatal state instead of “Unknown”.
Keep secure defaults
Prefer HTTPS for Control UI. If HTTP is unavoidable, scope allowed origins tightly and document the risk clearly for customers.