Security For OpenClaw

Treat every trust boundary as real.

Process

1. Identify inputs, outputs, and privilege boundaries.
2. List which surfaces accept untrusted data.
3. Check where secrets, tokens, or credentials might flow.
4. Validate assumptions about auth, authorization, and file access.
5. Reduce permissions and exposure where possible.
6. Verify the change does not create a broader attack surface than needed.

OpenClaw-Specific Focus