OpenClaw Security Checklist

Interactive checklist

Checks are stored in your browser localStorage only (not sent to our servers).

Reset all ticks

Core controls

• Gateway bound to localhost (or private IP only)
  Not reachable from the public internet. Use Tailscale or SSH tunnel for remote access. Network Isolation.
• Firewall rules applied; gateway port not exposed
  Host firewall deny-by-default. Network Isolation.
• Secrets in env / secrets manager; nothing in git
  chmod 600/640 on secret files. Credential Management.
• API spending limits set where supported
  Cap abuse blast radius. Credentials.
• Sandbox / tool restrictions appropriate for channel trust
  No unrestricted shell on untrusted chat. Best Practices.
• Logging + rotation configured
  Watch for anomalies. Monitoring hands-on.
• Installed skills audited; versions pinned
  Skills audit · Advisories.
• Regular update process defined
  Weekly or after advisories. Vulnerabilities.
• Dedicated non-root system user
  Matches the systemd example in best practices.
• Watchdog alert if Gateway unhealthy
  Telegram/Slack ping on failure.

Docker-specific

• docker.sock not mounted unless required
• Minimal volumes only
• CPU/memory limits set

Full guidance: Docker Hardening · Docker Deployment.

Post-Installation notes

Work through each item and verify before treating your instance as production-ready. Prefer the interactive list above; the downloadable Markdown is for offline audits.

Quick Verification Commands

Use these to sanity-check your setup (exact commands may vary by OpenClaw version):

# Check gateway and overall status
openclaw gateway status
openclaw status
openclaw health

# Validate configuration
openclaw config validate

# Run security audit
openclaw security audit

# Stream logs
openclaw logs --follow

For diagnostics, see Troubleshooting Guide and Security Best Practices.

Scenario-Based Quick Reference

Tail the checklist to your risk level (see Security Best Practices):

• Personal use (low-stakes): All core interactive items; optional extra firewall and minimal skill set.
• Small business (medium-risk): All items plus VPN/Tailscale for remote access, formal skills review, and consider managed hosting if no dedicated IT.
• Enterprise / regulated (high-stakes): Full isolation, secrets manager, strict sandbox and tool allowlists, audit logging, incident response plan, and regular reviews; align with GDPR/HIPAA as needed.

Related Resources

Next Steps

After completing the checklist:

• Schedule a quarterly run-through and after any major config or skill changes.
• Bookmark Known Vulnerabilities and official security advisories for CVE and ClawHub incident updates.
• Explore Use Cases and ClawHub skills with security in mind-audit before installing.