How to Set Up OpenClaw Safely

1) Start with least privilege

• Run OpenClaw as a non-root user.
• Grant only the minimum tool access needed for your workflows.
• Avoid broad filesystem permissions; scope workspace paths tightly.

2) Lock down network exposure

• Do not expose admin/gateway endpoints publicly without authentication and IP restrictions.
• Use firewall defaults-deny and allow only required ports.
• Prefer reverse proxy + TLS for any external access.

3) Protect credentials and tokens

• Store secrets in environment variables or a secret manager, never in repo files.
• Rotate tokens periodically and immediately after suspected leaks.
• Use separate credentials for dev/staging/prod.

4) Keep change control and audit trails

• Use version control for prompt/config/skill changes.
• Require explicit approvals for destructive actions.
• Log key operations and keep a rollback path.

5) Keep software updated

• Patch base OS and dependencies on a fixed cadence.
• Run periodic security health checks.
• Back up critical configs before upgrades.