# OpenClaw Security Checklist (printable)

Use before go-live and after major upgrades. Full guide: https://openclawroadmap.com/security-best-practices.php

## System
- [ ] Dedicated non-root user runs OpenClaw
- [ ] OS updates / unattended security updates planned
- [ ] SSH keys only; password root login disabled

## Network
- [ ] Gateway bound to 127.0.0.1 (or private Tailscale IP)
- [ ] UFW (or equivalent) deny-by-default; SSH limited by IP if possible
- [ ] Gateway / admin UI not exposed on 0.0.0.0
- [ ] Remote UI only via SSH tunnel or VPN

## Secrets
- [ ] API keys in env / secrets manager (mode 600/640)
- [ ] No secrets committed to git
- [ ] Provider spend caps enabled where available

## Application
- [ ] Shell / filesystem skills restricted on untrusted channels
- [ ] ClawHub skills audited and version-pinned
- [ ] Prompt policy refuses secret exfiltration
- [ ] Sandbox / workspace paths limited

## Operations
- [ ] Logs enabled and rotated
- [ ] Watchdog / alert if Gateway unhealthy
- [ ] Monthly review of skills, tokens, and firewall

## Docker (if used)
- [ ] docker.sock not mounted unless required
- [ ] Minimal volume mounts
- [ ] CPU/memory limits set

---
OpenClaw Roadmap — independent checklist (not official OpenClaw docs)
https://openclawroadmap.com/about-me.php