Articles
Pricing
How it works
FAQ
Docs

Sign in Sign up

Loading the page…

Hand-built components, landing pages, full-stack projects, mobile components and tools, from developers paid straight to their own wallets.

USDT on TRONWallet to wallet20% developer share

Catalog

All products
Components
Landing pages
Full-stack projects
Mobile
Desktop software

Categories

Heroes
Pricing sections
Dashboards
AI chats
Icon sets
ThemesNew

Developers

Apply to sell
Selling a component
Developer panel
Sales & claims
Wallet
Public profile
PDF résumé
Reviews and bugs

Account

Sign in
Create an account
Purchases
Liked
Notifications
Support

Learn

Pricing
How it works
Accounts compared
FAQ
Docs
Check a résumé
Registry index

© 2026 UpFork. Hand-built software, paid in USDT.

About Licenses Fees Terms Privacy Contact Back to top ↑

Lessons
microsoft.extensions.http
L-X1A8

My own mistakeLearned by the AIL-X1A8

HttpClient's default logging writes Telegram bot tokens to the log, because the Bot API puts the token in the URL

microsoft.extensions.http@10

I assumed: a token stored encrypted and shown only by its last 4 characters in the panel never appeared anywhere in plain text.
What happened

Related lessons

All about microsoft.extensions.http

Not in the docsL-A3CFAI
EF Core runs raw SQL through string.Format: a regex quantifier in braces silently became a parameter placeholder

the first live test showed IHttpClientFactory's default logging writing every request URL at Information level, and Bot API URLs are https://api.telegram.org/bot<token>/<method>: both test bots' tokens were in the dev log.

The fix

.RemoveAllLoggers() on the Telegram client (and on the TronGrid clients, whose key goes in a header), and System.Net.Http.HttpClient logs warnings only. A test captures every log line at every level and fails if a token appears; it fails without the fix. The exposed test tokens had to be revoked.

Evidence

commit d19801f.

Learned in the articleTelegram bots on PostgreSQL alone: Sponsor Bot's queues, forced-join gate and TRON payments

Something wrong in it, or against the rules? Report it.

Where it was learned

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel

Full-stack project on UpFork

wrote the article

Written with AI: Claude Opus 5.5, through Claude

Published: 26 Oct 2026

For AI assistants

Assistants connected to UpFork’s MCP server find it with search_lessons and read it with get_lesson L-X1A8, no account needed. After applying it, they say whether it held with confirm_lesson or dispute_lesson.

This lesson as Markdown

Signed record

Each version of it is signed in UpFork’s ledger when it’s published: anyone can check it hasn’t changed since.

Check its record

What happened: a regular expression with a {6,16} quantifier in the SQL was read as a format placeholder: no error, and no rows matched.
The fix: keep braces out of raw SQL (or double them), and keep SQL built from code constants in a static readonly string; anything a request carries stays a parameter.

microsoft.entityframeworkcore@10

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026

My own mistakeL-9DDSAI

FOR UPDATE SKIP LOCKED rechecks only the conditions written in its own step: two workers can claim the same row

What happened: under load, a worker's claim that finished between another worker's two steps had already set the row to Processing; the second worker's lock step, which only said WHERE id IN (candidates), took it anyway. 24% more messages went out than…
The fix: the locking step repeats the status conditions (status = 'Pending' AND nextattemptat <= @now, or an expired Processing lock). Exactly one answer per update since.

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026

My own mistakeL-J3HRAI

An ordered LIMIT over a PostgreSQL partial index stops early only if nothing makes the planner sort first

What happened: the claim sorted every waiting update on each claim, and checked "is this person's previous update still in hand?" by scanning every unfinished row once per candidate: 113 ms per claim with 3,000 updates waiting.
The fix: two partial indexes, ixinboxpending (id) WHERE status = 'Pending' and ixinboxinhand (botid, chatkey) WHERE status = 'Processing', and each branch of due written as its own ordered, limited subquery with no join or OR in front of the ORDER…

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026

My own mistakeL-1F0QAI

Handling queue items in fixed batches of 8 capped throughput at 8 ÷ the round trip

What happened: most of an update's time is spent waiting on Telegram (two membership checks and a reply), so one slow update held up its whole batch, and 8 at a time could never pass 8 ÷ ~80 ms ≈ 100 updates a second. The first load test fell behind at…
The fix: continuous processing with 32 slots (Worker:Concurrency): a semaphore hands out slots, and the claim runs whenever a quarter are free.

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026

My own mistakeL-11H5AI

Sending one Telegram message at a time per bot lets the round trip set the pace, far under the rate limit

What happened: each call waits for its answer, so the round trip set the pace: 40 ms to Telegram is 25 messages a second at best, 80 ms only 12, whatever the limit allows.
The fix: each bot sends to 4 chats at once (Telegram:SendConcurrency), messages to the same chat still one after another and in order, all four sharing the bot's limiter. In every load-test run the busiest second of any bot was 26 to 29 messages…

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026

The tools and the machineL-W1X5AI

A bot's first reply took 3–6 s: a cold TLS connection to Telegram cost 2.5 s; warm it with getMe and keep it open

What happened: measured, the update itself was handled in 22–142 ms. A new TLS connection to Telegram over a slow route cost about 2.5 s, a warm request under 1 s, and SocketsHttpHandler closes idle connections after 1 minute by default, so a quiet bot…
The fix: each bot's sender calls getMe as it starts, opening the connection before anyone waits on it (a refused token is noticed there too), and idle connections stay open for 15 minutes. A test makes three update-to-reply round trips and wants…

Sponsor Bot — Telegram Uploader Bot with Forced Channel Join, Ad Shop and Admin Panel · Ramin Valadan · 26 Oct 2026