diff --git a/security-monitor.sh b/security-monitor.sh
index f3e1d97..7335bab 100755
--- a/security-monitor.sh
+++ b/security-monitor.sh
@@ -42,8 +42,17 @@ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 export LC_ALL=C
 umask 077   # state files hold key fingerprints and source IPs
 
-TELEGRAM_BOT="8602530664:AAFE7tsRY79zhhEjU7sRR7MrS8p3FB0jvXg"
-TELEGRAM_CHAT_ID="108712105"
+# Telegram credentials live outside the script (it's in a public repo): a root-only env file
+# with TELEGRAM_BOT=... and TELEGRAM_CHAT_ID=... lines. Fail loudly if it's missing rather than
+# running a monitor that silently can't alert.
+TELEGRAM_ENV="${TELEGRAM_ENV:-/root/.security-monitor/telegram.env}"
+if [ ! -r "$TELEGRAM_ENV" ]; then
+    echo "ERROR: $TELEGRAM_ENV missing or unreadable — no way to send alerts" >&2
+    exit 1
+fi
+# shellcheck source=/dev/null
+. "$TELEGRAM_ENV"
+: "${TELEGRAM_BOT:?not set in $TELEGRAM_ENV}" "${TELEGRAM_CHAT_ID:?not set in $TELEGRAM_ENV}"
 
 DISK_ALERT_PCT="${DISK_ALERT_PCT:-90}"    # alert once usage reaches this
 DISK_RECOVER_PCT="${DISK_RECOVER_PCT:-85}"  # ...and don't re-arm until it drops back below this (hysteresis)