OpenClaw Security Audit: What to Check Before Production

You've built your OpenClaw-powered application, tested it locally, and you're ready to ship. But have you actually audited your security configuration? Most teams skip this step — and most breaches happen because of it.

A security audit isn't a one-time checkbox. It's a structured review of every layer of your deployment: authentication, authorization, secrets handling, network policies, logging, and more. The difference between "it works on my machine" and "it's safe in production" is this audit.

In this guide, we'll walk through a practical, hands-on security audit for OpenClaw. Every step includes specific commands you can run right now, expected outputs, and what to do when something fails. We'll cover the critical areas that catch 80% of vulnerabilities — and point you to The OpenClaw Security Guide for the complete 50+ checkpoint audit.

Time required: About 45-60 minutes for the checks in this article. Budget a full afternoon for a comprehensive audit using the complete guide.

The first thing to audit is your openclaw.config.yaml file. This single file controls most of your security posture, and misconfigurations here are the #1 source of production vulnerabilities.

Step 1: Dump your current configuration

# Export the full resolved config (including defaults)
openclaw config export --format yaml > /tmp/audit-config.yaml

# Compare against your committed config
diff openclaw.config.yaml /tmp/audit-config.yaml

Why? Hidden defaults can override your explicit settings. This diff shows you exactly what OpenClaw is actually running with, not just what you think it's running with.

Step 2: Check for dangerous defaults that haven't been overridden

# These should all return safe values
openclaw config get security.sandbox          # Expected: true
openclaw config get security.redact_secrets   # Expected: true
openclaw config get network.egress_policy     # Expected: allowlist
openclaw config get safety.confirm_before     # Expected: non-empty list
openclaw config get logging.level             # Expected: info or warn

Red flags to watch for:

• sandbox: false — Your agent has unrestricted filesystem access
• egress_policy: allow_all — Your agent can phone home to anywhere
• redact_secrets: false — Credentials will leak into logs and responses
• confirm_before: [] — No human review of destructive actions
• logging.level: debug — Debug logs may contain sensitive data in production

Step 3: Verify no dev overrides are leaking into production

# Check for environment-specific override files
ls -la .openclaw/
# In production, only production overrides should exist

# Check for environment variables that override config
env | grep OPENCLAW_ | sort

A common mistake: developers set OPENCLAW_SANDBOX=false in their local .bashrc for convenience, then that environment variable follows them into the production deployment through a Docker build or CI/CD pipeline.

Who can access your OpenClaw instance, and what can they do? If the answer is "everyone" and "everything," you have a problem.

Step 4: List all API keys and their permissions

# List all active API keys
openclaw auth list-keys --format table

# For each key, verify:
# - Is it still needed?
# - Are permissions scoped correctly?
# - When was it last rotated?
openclaw auth key-info <key-id>

What to look for:

• Keys with admin scope that should be read-only or agent-execute
• Keys older than 90 days (should be rotated)
• Keys assigned to people who've left the team
• Keys with no description (who created this? why?)

Step 5: Audit role assignments

# List all users and their roles
openclaw auth list-users --verbose

# Verify the principle of least privilege
# Developers should NOT have admin access in production
# CI/CD service accounts need only execute permissions

Step 6: Check for shared credentials

# Detect keys used from multiple IP addresses
openclaw auth audit --check shared-credentials

# If this returns results, those keys are likely shared
# between team members — create individual keys instead

Shared credentials are an audit nightmare. When something goes wrong, you can't trace who did what. Create individual API keys for every team member and every service, no exceptions.

Your OpenClaw agent talks to external services. The question is: which ones, and is that list what you intended?

Step 7: Review your network allowlist

# Show the current egress policy
openclaw config get network.egress_policy
openclaw config get network.allowed_domains

# Expected: a tight allowlist with ONLY the domains you actually use
# Bad sign: allow_all, or a wildcard like *.amazonaws.com

Step 8: Test the egress controls actually work

# Test allowed domain (should succeed)
openclaw network test api.openai.com
# Expected: OK — connection allowed

# Test blocked domain (should fail)
openclaw network test random-server.example.com
# Expected: BLOCKED — domain not in allowlist

# Test a sneaky bypass attempt
openclaw network test api.openai.com.evil.com
# Expected: BLOCKED — subdomain matching should be exact

Step 9: Review DNS configuration

# Check if DNS-over-HTTPS is enabled (prevents DNS leak attacks)
openclaw config get network.dns_over_https
# Expected: true

# Verify the DNS resolver
openclaw config get network.dns_resolver
# Should be a trusted resolver, not the system default

Common finding: Teams that use AWS or GCP add wildcard domains like *.amazonaws.com to their allowlist. This defeats the purpose — an attacker can set up an S3 bucket on AWS and your agent will happily send data there. Use specific service endpoints instead: s3.us-east-1.amazonaws.com, dynamodb.us-east-1.amazonaws.com.

If an incident happens and you don't have logs, you have no way to investigate. Audit your observability setup before you need it.

Step 10: Verify logging is production-ready

# Check logging configuration
openclaw config get logging.level          # Should be: info (not debug)
openclaw config get logging.format         # Should be: json
openclaw config get logging.include        # Should include: tool_calls, errors, external_requests
openclaw config get logging.exclude        # Should exclude: prompt_content, response_content

# Verify logs are actually being written
openclaw run --test "audit check" && sleep 2
tail -3 /var/log/openclaw/agent.log | jq '.'

Step 11: Check audit trail configuration

# Verify the audit system is on
openclaw config get audit.enabled          # Expected: true
openclaw config get audit.retention_days   # Should be >= 90 for compliance

# Test that audit records are being created
openclaw audit recent --limit 5 --format table

Step 12: Validate alerting is configured

# Check if alerts are set up for security events
openclaw config get alerts.channels
# Should have at least one channel (Slack, email, PagerDuty)

openclaw config get alerts.triggers
# Should include: sandbox_violation, auth_failure, rate_limit_exceeded

The audit checklist for logging:

• Logs are in JSON format (machine-parseable)
• Log rotation is configured (prevent disk exhaustion)
• Sensitive content (prompts, responses) is NOT logged
• Security events trigger immediate alerts
• Audit trail has at least 90 days retention
• Logs are shipped to a central system (not just local disk)

Your OpenClaw setup is only as secure as its weakest dependency. Plugins, packages, and container images all need reviewing.

Step 13: Audit installed plugins

# List all plugins with version and permissions
openclaw plugins list --verbose --format table

# For each plugin, check:
openclaw plugins audit <plugin-name>
# Shows: publisher verification, permission scope, last update, known CVEs

Step 14: Scan for known vulnerabilities

# Run the built-in vulnerability scanner
openclaw security scan --full

# Also run standard package audits
npm audit --production 2>/dev/null || true
pip audit 2>/dev/null || true

Step 15: Verify version pinning

# Check for unpinned dependencies
grep -E '"latest"|"\*"|"\^"' package.json openclaw.config.yaml

# Any matches = unpinned dependency = supply chain risk
# Pin every version explicitly

Quick audit checklist:

• All plugin versions are pinned (no latest, no ^ ranges)
• No known CVEs in any dependency
• Every plugin has a verified publisher
• Plugin permissions follow least-privilege principle
• Unused plugins are removed entirely
• A process exists for regular dependency updates

Here's a condensed version of every check in this article. Copy this into your team's wiki or CI pipeline:

# === OPENCLAW PRODUCTION SECURITY AUDIT ===
# Run before every production deployment

echo "=== Phase 1: Configuration ==="
openclaw config get security.sandbox
openclaw config get security.redact_secrets
openclaw config get network.egress_policy
openclaw config get safety.confirm_before
openclaw config export --format yaml > /tmp/audit-config.yaml

echo "=== Phase 2: Authentication ==="
openclaw auth list-keys --format table
openclaw auth list-users --verbose
openclaw auth audit --check shared-credentials

echo "=== Phase 3: Network ==="
openclaw network test api.openai.com
openclaw network test random-server.example.com
openclaw config get network.dns_over_https

echo "=== Phase 4: Logging ==="
openclaw config get logging.level
openclaw config get audit.enabled
openclaw config get alerts.channels

echo "=== Phase 5: Dependencies ==="
openclaw plugins list --verbose
openclaw security scan --full
npm audit --production 2>/dev/null

echo "=== AUDIT COMPLETE ==="

Set this up as a CI gate. This script should run in your deployment pipeline and block the deploy if any check fails. Prevention is always cheaper than incident response.

Also worth reading: our guides on 20 Things to Verify Before Going Live and Secrets Management for Teams for deeper dives into specific areas.

This article covers the first 15 checks of a production security audit. But a thorough audit includes much more:

• Compliance verification — GDPR data mapping, CCPA consumer rights handling, SOC 2 control documentation
• Incident response readiness — Do you have a runbook? Has the team practiced it?
• Backup and recovery testing — When did you last restore from a backup?
• Container and infrastructure security — Image scanning, runtime protection, network segmentation
• Team security training verification — Does everyone know what prompt injection looks like?

The difference between a basic audit and a comprehensive one is coverage. Basic audits catch the obvious issues. Comprehensive audits catch the ones that actually cause breaches — the subtle misconfigurations, the edge cases, the "we assumed that was configured correctly" gaps.

Don't wait for a security incident to discover what your audit missed.