Tinman
Security auditing and hardening for OpenClaw and system infrastructure.
Security Levels
| Level |
Description |
Response |
| S0 |
Info |
Log only |
| S1 |
Low |
Notify user |
| S2 |
Medium |
Alert + recommend fix |
| S3 |
High |
Immediate action required |
| S4 |
Critical |
Stop + notify immediately |
Checks
OpenClaw Security
| Check |
Risk |
Action |
| Credentials in git |
S3 |
Add to .gitignore, rotate |
| Token expiration |
S2 |
Refresh tokens |
| Exposed secrets |
S4 |
Rotate immediately |
| Uncommitted changes |
S1 |
Review + commit |
System Security
| Check |
Risk |
Action |
| SSH password auth |
S2 |
Disable, use keys only |
| Open ports |
S1 |
Review with ss -tlnp |
| Unattended upgrades |
S2 |
Enable automatic updates |
| Firewall status |
S2 |
Verify ufw/iptables |
Workflow
1. Security Scan
# Check for credentials in git
git log --all --full-history -- .credentials/
# Check file permissions
ls -la ~/.credentials/
# Check SSH config
cat /etc/ssh/sshd_config | grep -E "PasswordAuthentication|PermitRootLogin"
2. Report Generation
## Security Audit Report
**Date:** 2026-02-20
**Scope:** OpenClaw + System
### Findings
| Level | Issue | Recommendation |
|-------|-------|----------------|
| S2 | Token expires in 3 days | Refresh Google OAuth |
### Actions Taken
- [x] Verified .credentials/ permissions (600)
- [ ] Refresh expiring tokens
3. Automated Monitoring
{
"name": "daily-security-check",
"schedule": {"kind": "cron", "expr": "0 6 * * *"},
"payload": {
"kind": "agentTurn",
"message": "Run tinman security scan. Check: credential perms, token expiration, git secrets. Report S2+ issues."
},
"sessionTarget": "isolated",
"notify": true
}
Best Practices
- Credential hygiene — 600 permissions, never in git
- Token rotation — Before expiration
- Regular audits — Weekly automated scans
- Principle of least privilege — Minimal permissions
- Audit logging — Track all changes
Emergency Response
If S4 (Critical) detected:
- Stop — Halt related operations
- Assess — Scope of exposure
- Rotate — Change all affected credentials
- Review — How did it happen
- Prevent — Update processes
aibot88