As an open-source project, securing OpenClaw is ongoing work.
A trusted group of maintainers, including security engineers from NVIDIA and Tencent, volunteer their time to review reports, investigate issues, ship fixes, and strengthen the project as it evolves. A lot of this work happens behind the scenes, and we want to make more of it visible and easier to understand.
This week, we rolled out a security page for all to see where OpenClaw security stands, what we’re working on, what we’ve fixed, and how to reach us when something needs our attention.
The page brings together information that previously lived across GitHub, documentation, blog posts, and individual advisories. It includes:
- Current security status and advisories, including whether there are any active security bulletins.
- The numbers behind vulnerability reports. Since January, 722 fixes have been published. Fourteen reports resulted in confirmed critical vulnerabilities; all of them had been fixed and disclosed.
- Where fixes are happening, from gateway authentication and scopes to sandboxing, approvals, connectors, filesystem handling, plugins, skills, and network access.
- Ongoing security work, including ClawHub skill scanning, install blocking for malicious or quarantined skills, safer filesystem access, command-chain checks, network egress controls, and regression testing based on previously patched advisories.
- A clear vulnerability reporting process, including what makes a useful report, what happens after one is submitted, and what falls outside OpenClaw’s security model.
- Security research and write-ups, from both OpenClaw contributors and outside researchers.
We’re also making more of our underlying security work available. One recent example: OpenClaw has published an open dataset containing more than 67,000 ClawHub skill scans, alongside research into how different security scanners evaluate the same skills.
Our work is never done. OpenClaw connects models to tools, files, browsers, services, and other systems, and those capabilities create security boundaries that keep evolving with the project.
As a reminder, if you find a potential vulnerability, please report it privately to give our maintainers time to investigate and ship a fix before technical details are public.
Explore more at openclaw.ai/security. 🦞