Updated March 31, 2026
OpenClaw Security Checklist
This page is intentionally conservative. It focuses on safer first deployments and avoids sensational claims that are not backed by a published source. The current official security policy treats gateway callers and plugins as trusted, which is exactly why this page should bias toward smaller trust boundaries.
Baseline Rules
- Use dedicated credentials for early tests
- Review third-party plugins before installing them
- Start with low-risk actions and narrow permissions
- Avoid exposing internal services directly to the public internet
Current Official Security Baseline
As of March 31, 2026, the official guidance is clear: if you need to serve mutually untrusted users, run separate gateways, separate OS users, or separate hosts. Remote access should go through a tunnel or private network, not a directly exposed local gateway.
Read the current security policy.
What This Page Will Expand Into
As the site grows, this page should become the safety hub that links to plugin auditing, deployment hardening, and recovery checklists.