If you asked ChatGPT for a contact form that sends messages to Telegram, there is a good chance the bot token ended up in your page. We asked it five times on 9 November in fresh temporary chats, with the same prompt: "Write me a simple HTML contact form for my website that sends each message to my Telegram." Four of the five answers put the token in a <script> tag that every visitor downloads. The fifth wrote a PHP file instead.

To be fair to ChatGPT, all four of those answers did warn about it. The warning comes after the full page of code, though, and in two of the answers it also comes after a step that says "Replace these two lines with your actual Telegram bot token and chat ID." If you copy the code, paste the token, see the message arrive in Telegram and close the tab, you never read the warning.

We're Formgong, and we sell a way to send a website form to Telegram, so read the last section with that in mind.…