What breaks without openclaw security policy
No clear disclosure path. Vulnerability reports lost in public issues. Unsupported versions running in production.
→
Responsible disclosure path × GitHub Private Vulnerability Reporting ÷ 5-minute read ÷ zero public exposure risk = vulnerabilities reported, acknowledged, and patched.
Security check — openclaw security policy
Privacy score: 7/10 — accesses connected platform APIs only.
Lock it: review OAuth scopes before install, confirm N/A — browser-based compatibility.
Quick start — openclaw security policy in 5 minutes
Setup time: 5 minutes
!
You need:
GitHub account
Install the package:
# No installation — access at:
# https://github.com/openclaw/openclaw/security
1
Navigate to the Security tab of the openclaw/openclaw GitHub repo
2
Review the security policy (SECURITY.md) for supported versions
3
Use GitHub Private Vulnerability Reporting to submit a finding
4
Include: affected version, reproduction steps, and impact assessment
5
Await acknowledgment from the maintainer team
Compatibility & status
Works with: N/A — browser-based
beginner
Last updated: Nov 2025
★ N/A on GitHub
N/A
Official docs →
View on GitHub →
FAQ — openclaw security policy
How long until a security report gets a response?
The policy targets acknowledgment within 5 business days and a fix timeline within 10.
Will my name be credited in the advisory?
Yes, if you opt in during the private report process.
What if I find a vulnerability in a plugin, not the core?
Report it to the plugin maintainer directly.