Telegram-operated · Railway-hosted

Map your attack surface before someone else does.

ZEROScope GOV runs recon, web-surface, and exposure checks against your own infrastructure — triggered from a locked-down Telegram bot, with every session scoped to an operator allowlist.

01 · Capabilities

One bot, five scan categories

Every module is a slash command. Run them individually, chain them with /quick or /full, or drive the whole thing from the interactive wizard.

Recon & mapping

Know what's exposed

  • /ports — TCP scan, IPv4 + IPv6
  • /subs — Subdomain enum + CT logs
  • /cloud — S3 / GCS / Azure / DO / R2 buckets
Web surface

Audit the app layer

  • /files — Sensitive file hunt
  • /headers — Security header audit
  • /tls — TLS/SSL deep inspection
  • /js — JS secret extraction
  • /graphql — Introspection probe
Exposure testing

Check the boundaries

  • /ssrf — SSRF & cloud metadata checks
  • /k8s — Kubernetes & container exposure
Threat intelligence

Cross-reference findings

  • /intel — Shodan + VirusTotal + OTX
  • /epss — CVE enrichment, EPSS v4 + CISA KEV
Session & reporting

Work the findings

  • /architect — Guided AI defensive session
  • /payloads — Scoped test-case generation
  • /export — JSON report + STIX 2.1 bundle
02 · Deploy

Live in three steps

No servers to patch — Railway builds from your repo and keeps the bot running.

Register the bot

Message @BotFather on Telegram, run /newbot, and save the token it gives you.

Set your allowlist

Get your numeric ID from @userinfobot and add it as TELEGRAM_ALLOWED_IDS — only listed operators can talk to the bot.

Push to Railway

Connect the repo at railway.com — or run railway up from the CLI — and set your variables from the Raw Editor.

03 · Governance

Built to stay scoped

The controls that matter for running this against real infrastructure, on by default.

Operator allowlist

Only Telegram IDs listed in TELEGRAM_ALLOWED_IDS can issue a single command.

Rate limiting

Scan volume is capped per operator via RATE_LIMIT_SCANS and RATE_LIMIT_SECONDS.

Ephemeral reports

Findings land in a temp directory and don't persist — run /export to keep them.

Full logging

Every scan is recorded in Railway's deployment logs for after-the-fact review.

04 · Stack

What it runs on

Python 3.12 python-telegram-bot 22.8 httpx + aiohttp dnspython Hosted on Railway Worker process via Procfile