ZEROScope GOV runs recon, web-surface, and exposure checks against your own infrastructure — triggered from a locked-down Telegram bot, with every session scoped to an operator allowlist.
Every module is a slash command. Run them individually, chain them with /quick or /full, or drive the whole thing from the interactive wizard.
No servers to patch — Railway builds from your repo and keeps the bot running.
Message @BotFather on Telegram, run /newbot, and save the token it gives you.
Get your numeric ID from @userinfobot and add it as TELEGRAM_ALLOWED_IDS — only listed operators can talk to the bot.
Connect the repo at railway.com — or run railway up from the CLI — and set your variables from the Raw Editor.
The controls that matter for running this against real infrastructure, on by default.
Only Telegram IDs listed in TELEGRAM_ALLOWED_IDS can issue a single command.
Scan volume is capped per operator via RATE_LIMIT_SCANS and RATE_LIMIT_SECONDS.
Findings land in a temp directory and don't persist — run /export to keep them.
Every scan is recorded in Railway's deployment logs for after-the-fact review.