OpenClaw Security Checklist: 20 Things to Verify Before Going Live

Shipping fast is great. Shipping insecure is not. In 2026, OpenClaw deployments handle sensitive data, execute code, and interact with production infrastructure. One misconfiguration can expose your entire stack.

The problem? Most teams treat security as an afterthought. They build, test, ship — and then wonder why their API keys ended up on a breach notification list.

This checklist is designed to be run before every production deployment. Print it, bookmark it, paste it into your CI pipeline. We'll cover the first 7 items in detail here — each one with specific commands and configs you can use immediately.

For the complete 50+ checkpoint production checklist, see The OpenClaw Security Guide.

The single most common cause of security incidents: credentials accidentally passed to AI agents. Before going live, verify that OpenClaw's secret scanner is enabled and properly configured.

Run this command:

openclaw config get security.redact_secrets

Expected output: true. If it returns false or nothing, fix it now:

# openclaw.config.yaml
security:
  redact_secrets: true
  secret_patterns:
    - "sk-[a-zA-Z0-9]{20,}"       # OpenAI/Anthropic API keys
    - "ghp_[a-zA-Z0-9]{36}"       # GitHub personal access tokens
    - "postgres://.*"              # Database connection strings
    - "AKIA[0-9A-Z]{16}"          # AWS access key IDs
    - "xox[baprs]-[a-zA-Z0-9-]+"  # Slack tokens

Why it matters: A leaked API key takes seconds to exploit. Automated bots scan public repositories and AI service logs for credential patterns 24/7. This single check prevents the #1 cause of AI-related breaches.

Sandbox mode restricts what your AI agent can access on the host system. Without it, a prompt injection attack could read your SSH keys, modify system files, or exfiltrate data.

Check your sandbox status:

openclaw config get security.sandbox
# Expected: true

openclaw config get security.allowed_paths
# Should list ONLY the directories your agent needs

Recommended production config:

security:
  sandbox: true
  allowed_paths:
    - ./src
    - ./data/public
    - /tmp/openclaw-workspace
  denied_paths:
    - ~/.ssh
    - ~/.aws
    - ~/.config
    - /etc
    - /var

Test it: Try to access a denied path from within an agent session. It should be blocked with a SANDBOX_VIOLATION error. If it succeeds, your sandbox isn't working.

By default, OpenClaw agents can make HTTP requests to any domain. In production, this means a compromised agent could send your data to an attacker-controlled server — and you'd never know.

Set an explicit allowlist:

# openclaw.config.yaml
network:
  egress_policy: allowlist
  allowed_domains:
    - api.openai.com
    - api.anthropic.com
    - api.github.com
    - your-internal-api.company.com
  blocked_domains:
    - "*.pastebin.com"
    - "*.ngrok.io"
    - "*.requestbin.com"

Verify it's working:

# This should succeed (allowed domain)
openclaw network test api.github.com

# This should fail (blocked domain)
openclaw network test evil-server.example.com

Why it matters: Network egress control is your last line of defense. Even if an attacker gets code execution through prompt injection, they can't exfiltrate data if outbound connections are restricted.

In development, auto-approving agent actions saves time. In production, it's a disaster waiting to happen. One hallucinated rm -rf / or DROP TABLE and your day is ruined.

Enable confirmation for all write operations:

# openclaw.config.yaml
safety:
  confirm_before:
    - file_write
    - file_delete
    - shell_execute
    - db_write
    - api_call_external
  auto_approve:
    - file_read
    - db_read
    - api_call_internal

For CI/CD pipelines where no human is present, use a deny-by-default policy instead:

safety:
  unattended_mode: deny_destructive
  allowed_unattended:
    - file_read
    - db_read

Pro tip: Create a .openclaw/safety-overrides.yaml file per environment. Dev can be permissive, staging moderate, production strict. Never copy dev settings to production.

Third-party plugins are the supply chain attack vector for AI agents. Before going live, every installed plugin needs a security review.

List all installed plugins and their permissions:

openclaw plugins list --verbose

For each plugin, verify:

• Is it from a verified publisher?
• Does the version match what you tested? (No latest tags in production)
• Are the permissions reasonable? A markdown formatter shouldn't need network access
• When was the last security audit?

Pin every version explicitly:

# openclaw.config.yaml
plugins:
  - name: "@openclaw/tool-github"
    version: "2.1.3"           # Pinned — never use "latest"
    permissions:
      - api_call: "api.github.com"
      - file_read: "./src"
  - name: "@openclaw/tool-postgres"
    version: "1.4.7"
    permissions:
      - db_read: true
      - db_write: true

Remove unused plugins: Every plugin is attack surface. If you're not using it, uninstall it.

# Remove a plugin
openclaw plugins remove @openclaw/tool-unused

# Verify it's gone
openclaw plugins list

You can't secure what you can't see. Production deployments need structured, queryable logs that capture every agent action.

Enable production-grade logging:

# openclaw.config.yaml
logging:
  level: info
  format: json
  output:
    - stdout
    - file: /var/log/openclaw/agent.log
  include:
    - tool_calls
    - permissions_checks
    - errors
    - external_requests
    - token_usage
  exclude:
    - prompt_content        # Don't log sensitive prompts
    - response_content      # Don't log full responses

audit:
  enabled: true
  store: postgres
  retention_days: 90
  include_content: false    # Metadata only for compliance

Set up log rotation to prevent disk exhaustion:

# /etc/logrotate.d/openclaw
/var/log/openclaw/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
}

Quick health check: After enabling, run a test agent session and verify logs are being written:

openclaw run --test "hello world"
tail -5 /var/log/openclaw/agent.log | jq '.'

All communication between your OpenClaw instance and external services should be encrypted. This sounds obvious, but misconfigurations happen — especially with self-hosted deployments behind reverse proxies.

Verify TLS is enforced:

# Check if TLS verification is enabled
openclaw config get network.tls_verify
# Expected: true — NEVER set this to false in production

# Test the connection
openclaw network test --tls-check api.openai.com

Ensure data-at-rest encryption for local storage:

# openclaw.config.yaml
storage:
  encryption: aes-256-gcm
  key_source: env            # Read key from environment variable
  key_env_var: OPENCLAW_ENCRYPTION_KEY

Generate an encryption key if you don't have one:

openssl rand -hex 32
# Add the output to your environment:
# export OPENCLAW_ENCRYPTION_KEY="your-generated-key"

Common mistake: Setting tls_verify: false to "fix" certificate errors during development, then forgetting to re-enable it. This makes you vulnerable to man-in-the-middle attacks. Fix the certificate issue properly instead.

Here's a quick overview of the remaining items on the checklist. Each one is critical for production, and you can find the complete walkthrough — with configs, commands, and troubleshooting — in The OpenClaw Security Guide.

• #8 — Rate Limiting: Configure per-user and per-agent rate limits to prevent abuse and runaway costs
• #9 — Role-Based Access Control (RBAC): Define who can do what — not every team member needs admin access to your AI agents
• #10 — Prompt Injection Defense: Enable input sanitization and output validation to catch injection attempts
• #11 — Container/Process Isolation: Run agents in isolated containers so a compromise doesn't spread
• #12 — Backup Verification: Test that your backups actually restore. Untested backups are not backups
• #13 — Dependency Scanning: Run npm audit or equivalent — don't ship known vulnerabilities
• #14 — Environment Variable Hygiene: No secrets in code, no .env files in version control
• #15 — API Key Rotation Schedule: Keys should rotate every 90 days maximum. Automate it
• #16 — Incident Response Plan: Know what to do before something breaks, not after
• #17 — Data Classification: Label what's sensitive. Your agent should know which data it can and can't process
• #18 — Session Timeout Configuration: Idle agent sessions should expire. Don't leave doors open
• #19 — Update Verification: After updating, run your security test suite. Don't assume updates don't break security
• #20 — Compliance Documentation: GDPR, CCPA, SOC 2 — document your controls before auditors ask

Here's the order we recommend for maximum impact in minimum time:

1. Right now (15 minutes): Items #1-3 — secret scanning, sandbox mode, and network egress. These three alone block 70% of common attack vectors.
2. Before going live (30 minutes): Items #4-7 — confirmation mode, plugin audit, logging, and TLS. This gives you visibility and control.
3. First week in production (2 hours): Items #8-20 — rate limiting, RBAC, incident response, and compliance. This hardens your deployment for the long term.

Don't ship without at least items #1-7 checked off. They're the difference between a secure deployment and an incident waiting to happen.

This checklist covers the essentials, but every production environment has unique requirements. Team size, data sensitivity, regulatory obligations, and architecture choices all affect what additional controls you need.

For the complete production security playbook — including 50+ checkpoints, copy-paste configurations, GDPR/CCPA compliance templates, team onboarding checklists, and incident response procedures — get The OpenClaw Security Guide. It's everything we wish existed when we first deployed OpenClaw in production.