Parse links before choosing an action
t.me and tg: routes can represent messages, invites, themes, invoices and other features. Use documented fallback behavior for unknown routes instead of guessing a username. MTProto IDs and Bot API dialog IDs are not interchangeable.
Action bars reflect current context
Contact, reporting and Business Bot controls depend on peer settings and their updates. A stale button must not bypass current permissions.
Web events need a trust boundary
Games, payment pages and Mini Apps use defined events through environment-specific bridges. A familiar event name does not establish a trusted sender.
Implementation recommendations
Allowlist origins, message structures and actions. Tolerating unknown fields must not become accepting arbitrary commands. Route payments, authorization and joining through their confirmation flows. Log type and result rather than entire links containing authentication tokens.