EcoDEv Trade server security notes:
- Never ship config.php or the Telegram token in the APK.
- Keep directory listing disabled and storage blocked from HTTP.
- Use HTTPS only.
- Rotate the bot token if it has ever been exposed outside the server.
- Restrict telegram_admin_ids to trusted numeric Telegram user IDs.
- Keep cPanel/PHP updated and use strong hosting credentials.
