The Security Checklist

An OpenClaw agent can run commands, read files and act on messages from the outside world. That is the point of it, and also the danger. Wherever you run it, a short list of habits shrinks the danger to a size you can live with.

The rule

Shrink what it can reach, who can reach it, and how long leaks last.

1. What the agent can reach

• Deploy it on an isolated VPS, virtual machine or dedicated device, not on your personal computer.
• Run OpenClaw as a normal user, never as root, so a compromised agent cannot take over the whole machine.
• Start with read-only access and widen permissions on purpose, using the per-agent tool allow and deny lists.

2. Who can reach the agent

• Bind the Gateway to localhost, never 0.0.0.0. Keep the ports OpenClaw opens (18789 and 18793 in a default setup) closed to the internet, and reach it through Tailscale or a reverse proxy instead.
• Set a strong, random Gateway auth token before exposing any service.
• Turn on device pairing and keep the sender allowlist as short as possible.
• Never trust external content. An email or web page can contain text written to trick the agent into doing something you did not ask for. This is called prompt injection. Anything the agent reads is, in effect, a stranger talking to it.

3. How long a leak lasts

• Keep API keys in environment variables or a secrets manager, never written into code or config files, where logs, version control or error messages can expose them.
• Run openclaw security audit --deep after every config change, to catch a mistake before someone else finds it.
• Update OpenClaw regularly; many security fixes arrive in small patch releases.
• If you suspect a breach, rotate every credential at once: API keys, tokens and passwords.

The shortcut

For any setting, ask: "Does this widen reach, widen exposure, or lengthen a leak?" If the answer is yes, the setting needs a reason you can say out loud.

Drills

Answer fast — trust the rule.

Remember

• Shrink what it can reach, who can reach it, and how long leaks last.
• Ask of any setting: does it widen reach, widen exposure, or lengthen a leak?
• Trap: forgetting that content the agent reads is input from strangers.