Public Conversation Links: What They Leak

From v2026.10.5, a published conversation opens at its normal chat address. Anyone with the link can read the transcript without signing in. Signed-in readers use the same link with their existing permissions. Official notes: review the conversation before publishing.

Treat the URL as a capability. Do not paste it into a public Discord while the thread still holds tokens, home paths, or customer names.

Before you publish

  • Search the thread for API keys, .env dumps, and openclaw config snippets.
  • Strip channel identifiers, phone numbers, and mail subjects that are not yours to share.
  • Remember tool output may include local file paths.
  • If you only need a colleague to comment, keep them signed in rather than publishing.

Revoke when you can

v2026.9.3 already mentioned revocable chat links. If your build still shows a revoke or unpublish control, use it when the URL leaked. After unpublish, assume copies of the HTML exist. Rotate any secret that appeared in the transcript. Credential hygiene: credential management.

Related