mirror of
https://github.com/openclaw/openclaw.git
synced 2026-02-08 21:09:23 +08:00
74fbbda283
Add threat model (MITRE ATLAS), contribution guide, and security directory README. Update SECURITY.md with trust page reporting instructions and Jamieson O'Reilly as Security & Trust. Co-Authored-By: theonejvo <theonejvo@users.noreply.github.com>
78 lines
2.3 KiB
Markdown
78 lines
2.3 KiB
Markdown
# Security Policy
|
|
|
|
If you believe you've found a security issue in OpenClaw, please report it privately.
|
|
|
|
## Reporting
|
|
|
|
For full reporting instructions - including which repo to report to and how - see our [Trust page](https://trust.openclaw.ai).
|
|
|
|
Include: reproduction steps, impact assessment, and (if possible) a minimal PoC.
|
|
|
|
## Security & Trust
|
|
|
|
**Jamieson O'Reilly** ([@theonejvo](https://twitter.com/theonejvo)) is Security & Trust at OpenClaw. Jamieson is the founder of [Dvuln](https://dvuln.com) and brings extensive experience in offensive security, penetration testing, and security program development.
|
|
|
|
## Bug Bounties
|
|
|
|
OpenClaw is a labor of love. There is no bug bounty program and no budget for paid reports. Please still disclose responsibly so we can fix issues quickly.
|
|
The best way to help the project right now is by sending PRs.
|
|
|
|
## Out of Scope
|
|
|
|
- Public Internet Exposure
|
|
- Using OpenClaw in ways that the docs recommend not to
|
|
- Prompt injection attacks
|
|
|
|
## Operational Guidance
|
|
|
|
For threat model + hardening guidance (including `openclaw security audit --deep` and `--fix`), see:
|
|
|
|
- `https://docs.openclaw.ai/gateway/security`
|
|
|
|
### Web Interface Safety
|
|
|
|
OpenClaw's web interface is intended for local use only. Do **not** bind it to the public internet; it is not hardened for public exposure.
|
|
|
|
## Runtime Requirements
|
|
|
|
### Node.js Version
|
|
|
|
OpenClaw requires **Node.js 22.12.0 or later** (LTS). This version includes important security patches:
|
|
|
|
- CVE-2025-59466: async_hooks DoS vulnerability
|
|
- CVE-2026-21636: Permission model bypass vulnerability
|
|
|
|
Verify your Node.js version:
|
|
|
|
```bash
|
|
node --version # Should be v22.12.0 or later
|
|
```
|
|
|
|
### Docker Security
|
|
|
|
When running OpenClaw in Docker:
|
|
|
|
1. The official image runs as a non-root user (`node`) for reduced attack surface
|
|
2. Use `--read-only` flag when possible for additional filesystem protection
|
|
3. Limit container capabilities with `--cap-drop=ALL`
|
|
|
|
Example secure Docker run:
|
|
|
|
```bash
|
|
docker run --read-only --cap-drop=ALL \
|
|
-v openclaw-data:/app/data \
|
|
openclaw/openclaw:latest
|
|
```
|
|
|
|
## Security Scanning
|
|
|
|
This project uses `detect-secrets` for automated secret detection in CI/CD.
|
|
See `.detect-secrets.cfg` for configuration and `.secrets.baseline` for the baseline.
|
|
|
|
Run locally:
|
|
|
|
```bash
|
|
pip install detect-secrets==1.5.0
|
|
detect-secrets scan --baseline .secrets.baseline
|
|
```
|