Security

OpenClaw ships with conservative defaults. On a regular host install the Gateway binds to loopback; most chat channels answer an unknown DM sender with a pairing code instead of processing the message; and group access is allowlisted, usually behind a mention gate. The exceptions are deliberate and documented: container images default to an exposed bind (pair that with auth - see the exposure runbook), and a few workspace channels such as ClickClack trust workspace membership by default - each channel page states its exact defaults. Run on those defaults and you are in good shape, and one command tells you if you have drifted:

openclaw security audit

The pages below are the deep end: the trust model, what the audit checks, and how to harden further as you expose more surface.

Security pages

Understand the model:

• Security trust model - One trust boundary per gateway, the boundary matrix, and the findings closed as no-action.
• Running the security audit - What openclaw security audit checks and the order to fix findings in.
• Security audit checks - Reference catalog of every checkId, its severity, and its auto-fix support.
• Threat model - Adversarial threats to the OpenClaw platform and ClawHub, mapped to MITRE ATLAS.

Harden a deployment:

• Hardened baselines - Copy/paste configs that keep the Gateway local, paired, and tool-restricted.
• Access control and allowlists - DM policy, allowlists, DM session isolation, context visibility, command authorization.
• Prompt injection - Untrusted content reaching the model, model choice, and the wrapping that bounds it.
• Tool and agent permissions - Control-plane tools, node execution, plugins, sandboxing, per-agent profiles.
• Browser control risks - What a real browser exposes, and the SSRF policy that bounds it.
• Network exposure - Bind, firewall, discovery, Gateway auth, Tailscale, reverse proxy, dangerous flags.
• Secrets, storage, and logs - What lands on disk, which files hold credentials, and what transcripts contain.
• Secure file operations - Root-bounded file access, atomic writes, and archive extraction helpers.
• Dependency locking - How published packages pin and resolve their dependency graph.

Expose and operate:

• Gateway exposure runbook - Pre-flight and rollback checklist before exposing the Gateway beyond loopback.
• Trusted proxy auth - Running the Gateway behind a reverse proxy that supplies the operator identity.
• Rate limiting - Every Gateway rate limit: lockouts, throttles, caps, and cooldowns.
• Operator incident response - Contain, rotate, audit, and collect evidence after a suspected compromise.

Run it from the CLI:

• openclaw security - Run the audit, read findings, and apply the supported auto-fixes.
• openclaw policy - Inspect and test the tool policy the guidance above configures.

Where each section moved

Every anchor this page used to publish still resolves here. Each entry below carries the original anchor and links to its new home.

Security trust model

• Scope: one trust boundary per gateway
• Trust boundary matrix
• Not vulnerabilities by design
• Common findings closed as no-action
• Gateway and node trust
• Threat model
• Reporting security issues

Running the security audit

• openclaw security audit
• What the audit checks (high level)
• Priority order when triaging findings

Hardened baselines

• Hardened baseline in 60 seconds
• Requester-scoped controls and prompt context
• Secure baseline (copy/paste)
• Separate numbers (WhatsApp, Signal, Telegram)

Access control and allowlists

• DM access: pairing, allowlist, open, disabled
• Allowlists (two layers)
• DM session isolation (multi-user mode)
• Context visibility vs trigger authorization
• Command authorization

Prompt injection

• Prompt injection
• External content and untrusted-input wrapping
• Bypass flags (keep off in production)
• Reasoning and verbose output in groups

Tool and agent permissions

• Control plane tools
• Node execution (system.run)
• Dynamic skills (watcher / remote nodes)
• Plugins
• Sandboxing
• Sub-agent delegation guardrail
• Read-only mode
• Per-agent access profiles (multi-agent)
• Full access (no sandbox)
• Read-only tools + read-only workspace
• No filesystem/shell access (provider messaging allowed)

Browser control risks

• Browser control risks
• Browser SSRF policy (strict by default)

Network exposure

• Network exposure
• Bind, port, firewall
• Docker port publishing with UFW
• mDNS/Bonjour discovery
• Gateway WebSocket auth
• Tailscale Serve identity headers
• Reverse proxy configuration
• HSTS and origin notes
• Control UI over HTTP
• Insecure/dangerous flags
• Flags tracked by the audit today
• All dangerous*/dangerously* keys in the config schema

Secrets, storage, and logs

• Deployment and host trust
• Secrets on disk
• Credential storage map
• File permissions
• Workspace .env files
• Logs and transcripts
• Secret scanning

Operator incident response

• Incident response
• Contain
• Rotate (assume compromise if secrets leaked)
• Audit
• Collect for a report