OpenClaw

OpenClaw Security Hardening for Production👨‍💻

Hardening OpenClaw for production requires configuring multiple security layers that work together. Sandbox modes control how agents execute commands -- from unrestricted (off) to fully isolated (strict). Tool access control uses allow and deny lists to restrict what each agent can do. Elevated access provides a controlled way for agents to temporarily request restricted tools with user approval. Network isolation limits what agents can reach over the network. Secrets management keeps credentials out of configuration files. This page covers each layer in depth with production-ready configurations.

Key Takeaways

  • 1Three sandbox modes provide graduated isolation: `off` gives unrestricted access (development only), `basic` restricts shell environment and limits environment variable exposure, and `strict` adds filesystem restrictions, network isolation, and minimal system call whitelisting.
  • 2Tool access control is enforced per agent via `tools.allow` (whitelist) and `tools.deny` (blacklist). The deny list acts as defense in depth -- even if the allow list is misconfigured, explicitly denied tools are always blocked. Every agent in production should have both lists configured.
  • 3Elevated access allows agents to temporarily request tools outside their allow list. It requires explicit user approval, is time-limited (configurable maxDuration), and all elevated actions are logged for audit. This provides flexibility without permanently expanding an agent's permissions.
  • 4Network isolation in strict sandbox mode restricts which hosts an agent can reach. Configure allowedHosts to whitelist specific domains (your API, GitHub) and block everything else. This prevents data exfiltration through prompt injection attacks.
  • 5Secrets management uses the `${VAR_NAME}` syntax to reference environment variables in openclaw.json. API keys, bot tokens, and credentials should never be hardcoded. Use .env files for development and a secrets manager (Vault, AWS Secrets Manager, Doppler) for production.
  • 6The security audit command `openclaw config validate --strict` checks for common misconfigurations: sandbox off, missing deny lists, hardcoded secrets, unrestricted channel access, and missing TLS. Run it before every production deployment.

Master openclaw security hardening for production

Take the OpenClaw for Production & Advanced Use course with hands-on lessons and challenges.

Examples

Sandbox modes: off, basic, and strict compared

json

The dev-assistant has sandbox off for local development only -- never use this in production. The code-reviewer has basic sandboxing that hides sensitive environment variables and restricts SSH access. The public-support agent has strict sandboxing with filesystem restrictions (only /workspace and /tmp), network restrictions (only your API and GitHub), and resource limits. Scope: tree on the public-support agent ensures sub-agents inherit these restrictions.

Defense-in-depth tool access control

json

Each agent has the minimum tools it needs (allow) and an explicit blocklist (deny) as a safety net. The code-reviewer can read and analyze code but cannot write files or run commands. The deployer can execute deployments but cannot modify source code. The public-bot can only query the knowledge base -- all action tools are explicitly denied. The deny list catches misconfiguration: if someone accidentally adds bash to the public-bot's allow list, the deny list still blocks it.

Elevated access with time limits and audit trail

bash

This configuration adds rate limiting (maxElevationsPerHour), a cooldown period between elevations, and notifications on every elevation event. ApprovalChannels restricts where elevation approvals can be issued -- only Telegram admins can approve, even if the agent runs on Discord. These controls prevent abuse while maintaining flexibility for legitimate needs.

Network isolation for strict sandbox

json

Network isolation restricts which hosts the agent can connect to. The allowedHosts whitelist permits only your API, docs, and GitHub. The blockedHosts list explicitly blocks internal services and cloud metadata endpoints -- a common target for prompt injection attacks. AllowedPorts restricts to HTTP/HTTPS only. The DNS resolver override prevents DNS-based exfiltration attacks.

Production security validation checklist

bash

The validate command performs automated security checks against your configuration. Integrate it into your CI/CD pipeline to catch misconfigurations before deployment. The manual checks supplement the automated validation with network-level tests for TLS and rate limiting that the config validator cannot perform.

Common Mistakes

Mistake:

Deploying to production with sandbox: off on any agent, even 'trusted' internal agents that only the team uses

Fix:

Use at least basic sandboxing for every agent in production. Even internal agents are vulnerable to prompt injection through pasted content, forwarded messages, or malicious links. Sandbox: off should only exist on developer laptops.

Mistake:

Configuring tools.allow but not tools.deny, relying entirely on the whitelist and leaving no safety net for misconfiguration

Fix:

Always configure both lists. The deny list catches mistakes in the allow list. If someone accidentally adds bash to a reviewer's allow list, the deny list still blocks it. This is defense in depth.

Mistake:

Disabling elevation approval (requireApproval: false) for convenience, allowing agents to self-escalate their tool access without human oversight

Fix:

Elevation without approval means agents can grant themselves any tool at any time. This defeats the purpose of tool access control entirely. Always require approval, and restrict approvalChannels to admin-only channels.

Mistake:

Not blocking cloud metadata endpoints (169.254.169.254, metadata.google.internal) in strict sandbox, leaving agents vulnerable to credential theft via prompt injection

Fix:

Always add cloud metadata endpoints to the blockedHosts list. Prompt injection attacks commonly target these endpoints to steal service account tokens and instance credentials. This is especially critical for public-facing agents.

Mistake:

Storing API keys and bot tokens directly in openclaw.json and committing the file to version control

Fix:

Use ${VAR_NAME} syntax for all secrets. Store values in .env files (gitignored) for development and a secrets manager for production. Rotate keys immediately if they are ever committed to Git.

Best Practices

  • Layer your security: sandbox mode (how agents execute) + tool access control (what agents can do) + channel restrictions (who can talk to agents) + network isolation (what agents can reach). Each layer catches what the others miss.
  • Use strict sandbox with scope: tree for all public-facing agents and orchestrators. Basic sandbox is acceptable for internal agents with trusted users. Sandbox off should never appear in production configurations.
  • Run `openclaw config validate --strict` in your CI/CD pipeline before every deployment. Fail the pipeline if any security check does not pass.
  • Block cloud metadata endpoints (169.254.169.254, metadata.google.internal) in all strict sandbox configurations. This prevents prompt injection attacks from stealing instance credentials.
  • Rotate API keys and bot tokens on a regular schedule. Use a secrets manager that supports automatic rotation. Audit access logs for unusual patterns that may indicate credential compromise.
  • Configure elevation with rate limits (maxElevationsPerHour), cooldown periods, and admin-only approval channels. Monitor elevation logs weekly to identify agents that may need their base tool set expanded.

Summary

Hardening OpenClaw for production requires layered security: sandbox modes (off, basic, strict) control execution, tool allow/deny lists restrict per-agent capabilities, elevated access provides controlled temporary escalation with approval, network isolation prevents data exfiltration, and secrets management keeps credentials out of configuration files. Use strict sandbox with scope: tree for public-facing agents. Always configure both allow and deny lists. Block cloud metadata endpoints. Run `openclaw config validate --strict` before every deployment. Never deploy with sandbox: off.

Practice OpenClaw with hands-on challenges

Learn openclaw security hardening for production hands-on in your IDE

Interactive lessons and challenges on Stanza, practice in VS Code, Cursor, or the web.

Related Concepts

Related Cheatsheets

Master OpenClaw with Stanza

Interactive lessons and challenges, right in your code editor.

Check the free courses. No credit card.