OpenClaw Security Checklist: 13 Checks Before You Run It

Step 0: Run the Built-In Security Audit

Before anything else, let OpenClaw scan itself for misconfigurations:

This detects risky DM policies, misconfigured sandbox settings, missing authentication, world-writable state directories, and other critical warnings.

The 13-Point Security Checklist

The most critical setting. This keeps the gateway on 127.0.0.1:18789 and blocks all external network access. Never expose port 18789 publicly.

{
  "gateway": {
    "mode": "local",
    "bind": "loopback"
  }
}

Require a token for all gateway connections:

{
  "gateway": {
    "auth": {
      "mode": "token",
      "token": "your-long-random-token-here"
    }
  }
}

Generate a strong token with: openssl rand -hex 32

Check what's exposed on your machine:

Close any unnecessary services. Only ports 18789 and 18790 should be accessible, and ideally only on localhost.

• Disable password authentication — use SSH key-based auth only
• Restrict SSH access by IP address
• Move SSH off default port 22 where possible

Create a dedicated system user with minimal required permissions. Running as root means a compromised agent has full system control — it can read any file, kill any process, and modify any setting.

Sensitive paths to protect:

• WhatsApp creds: ~/.openclaw/credentials/whatsapp/
• Auth profiles: ~/.openclaw/agents/<agentId>/agent/auth-profiles.json
• Session transcripts: ~/.openclaw/agents/<agentId>/sessions/*.jsonl

By default, OpenClaw has broad tool access. Lock it down:

{
  "tools": {
    "profile": "messaging",
    "deny": [
      "group:automation",
      "group:runtime",
      "group:fs",
      "sessions_spawn"
    ],
    "fs": { "workspaceOnly": true },
    "exec": { "security": "deny", "ask": "always" }
  }
}

Always deny control-plane tools by default: gateway, cron, sessions_spawn, sessions_send.

Mandate explicit human approval before:

• Sending emails to external recipients
• Deleting or modifying files
• Financial transactions or payments
• Production deployments
• Shell commands with write access

{
  "session": { "dmScope": "per-channel-peer" },
  "channels": {
    "whatsapp": {
      "dmPolicy": "pairing",
      "groups": { "*": { "requireMention": true } }
    }
  }
}

The dmPolicy: "pairing" approach gives unknown senders expiring pairing codes, preventing unauthorized access to your agent.

• Store API keys as environment variables, not in config files
• Use a secrets manager with auto-rotating tokens where possible
• Never store SSH keys or production credentials inside the workspace directory
• Rotate credentials immediately upon any suspected compromise

Prompt injection is listed by OWASP as the #1 risk for LLM applications. Attackers embed hidden instructions inside content the agent reads — emails, GitHub issues, web pages, or screenshots.

Mitigations:

• Sanitize all external inputs before the agent processes them
• Separate system instructions from data layers
• Implement output validation before any command execution
• Use only the latest instruction-hardened model versions

Default mDNS mode exposes filesystem paths and SSH port details on your local network. Disable or minimize it:

{
  "discovery": {
    "mdns": { "mode": "minimal" }
  }
}

{
  "logging": {
    "redactSensitive": "tools",
    "redactPatterns": ["your-custom-pattern"]
  }
}

Session transcripts can contain pasted secrets, file contents, and command output. Prune old transcripts if long retention isn't needed.

The 60-Second Hardened Baseline

Copy this into your ~/.openclaw/openclaw.json as a secure starting point:

{
  "gateway": {
    "mode": "local",
    "bind": "loopback",
    "auth": { "mode": "token", "token": "YOUR_TOKEN" }
  },
  "session": { "dmScope": "per-channel-peer" },
  "tools": {
    "profile": "messaging",
    "deny": ["group:automation", "group:runtime",
             "group:fs", "sessions_spawn"],
    "fs": { "workspaceOnly": true },
    "exec": { "security": "deny", "ask": "always" }
  },
  "channels": {
    "whatsapp": {
      "dmPolicy": "pairing",
      "groups": { "*": { "requireMention": true } }
    }
  },
  "discovery": { "mdns": { "mode": "minimal" } },
  "logging": { "redactSensitive": "tools" }
}

If Something Goes Wrong: Incident Response

Need a Security-Hardened OpenClaw Deployment?

At Codeloop, we deploy production-grade OpenClaw installations with enterprise security — gateway hardening, network isolation, prompt injection defenses, and automated credential rotation. See how companies are safely running AI agents in production. We handle the security so your agents can focus on work.