dvcrn Security Hardener
Audit your OpenClaw configuration and apply security best practices automatically.
Quick Start
# Full security audit (read-only, no changes)
python scripts/hardener.py audit
# Audit a specific config file
python scripts/hardener.py audit --config /path/to/openclaw.json
# Audit with JSON output
python scripts/hardener.py audit -f json
# Auto-fix issues (creates backup first)
python scripts/hardener.py fix
# Fix specific issues only
python scripts/hardener.py fix --only gateway,permissions
# Scan for exposed credentials in config
python scripts/hardener.py scan-secrets
# Generate a security report
python scripts/hardener.py report -o security-report.md
# Check file permissions
python scripts/hardener.py check-perms
Commands
| Command | Args | Description |
|---|---|---|
audit |
[--config PATH] [-f FORMAT] |
Full security audit (read-only) |
fix |
[--config PATH] [--only CHECKS] |
Auto-fix issues (with backup) |
scan-secrets |
[--config PATH] |
Scan for exposed API keys/tokens |
report |
[-o FILE] |
Generate detailed security report |
check-perms |
[--config-dir PATH] |
Check file permissions |
Security Checks
| Check | Severity | Description |
|---|---|---|
gateway-bind |
CRITICAL | Gateway not bound to loopback |
exposed-keys |
CRITICAL | API keys in config instead of .env |
insecure-auth |
HIGH | allowInsecureAuth or dangerouslyDisableDeviceAuth enabled |
exec-sandbox |
HIGH | exec sandbox mode not set to restricted |
file-perms |
HIGH | Config files readable by others (not 600) |
agent-allow-all |
MEDIUM | agentToAgent.allow: ["*"] is overly permissive |
no-heartbeat |
MEDIUM | No heartbeat configured (can't detect outages) |
no-session-reset |
MEDIUM | No session reset policy (memory leak risk) |
no-pruning |
LOW | No context pruning (cost and performance impact) |
no-memory-flush |
LOW | Memory flush disabled (context loss on pruning) |
Scoring
The audit produces a security score from 0-100:
- 90-100: Excellent — production-ready
- 70-89: Good — minor improvements recommended
- 50-69: Fair — several issues to address
- 0-49: Poor — critical issues require immediate attention
Example Output
╔══════════════════════════════════════════════════╗
║ OPENCLAW SECURITY AUDIT ║
╠══════════════════════════════════════════════════╣
║ Score: 75/100 (Good) ║
║ ║
║ ✅ Gateway bound to loopback ║
║ ✅ No exposed API keys in config ║
║ ⚠️ exec sandbox mode: unrestricted ║
║ ⚠️ agentToAgent allow: * (too permissive) ║
║ ❌ File permissions too open (644 → should be 600) ║
║ ✅ Heartbeat configured ║
║ ✅ Session reset policy active ║
║ ⚠️ No context pruning configured ║
╚══════════════════════════════════════════════════╝