Problem
sender_handling() always overwrites saved chat_id with the sender of the latest message. Any Telegram user who can message the bot can become the authorised chat. Even though sender_handling() notifies the Telegram chat that chat_id has been changed and allows you to change it back, it is still not a sufficient protection.
Expected behaviour
Only an authorised user or explicit pairing flow should be able to change the saved Telegram chat ID.
Suggested fix
Require a pairing/reset command, admin confirmation, or only allow auto-binding when the stored chat ID is still the initial placeholder.
Problem
sender_handling() always overwrites saved chat_id with the sender of the latest message. Any Telegram user who can message the bot can become the authorised chat. Even though sender_handling() notifies the Telegram chat that chat_id has been changed and allows you to change it back, it is still not a sufficient protection.
Expected behaviour
Only an authorised user or explicit pairing flow should be able to change the saved Telegram chat ID.
Suggested fix
Require a pairing/reset command, admin confirmation, or only allow auto-binding when the stored chat ID is still the initial placeholder.