Security Audit in CI/CD

+15 Mana ✨
OpenClaw Security(DOCUMENTATION)

Introduction

OpenClaw includes a built-in security audit tool that scans your gateway configuration for vulnerabilities, misconfigurations, and security anti-patterns. Integrating this audit into your CI/CD pipeline ensures that insecure configurations are caught before deployment.

Key Concepts

  • Security Audit: The openclaw security audit command that scans configuration files for security issues.
  • Deep Mode: The --deep flag enables thorough scanning including dependency checks and permission analysis.
  • Auto-Fix: The --fix flag automatically corrects common security issues.
  • JSON Output: The --json flag produces machine-readable output for CI/CD integration.

Real World Context

A platform team adds the OpenClaw security audit to their GitHub Actions workflow. Every pull request that modifies gateway configuration triggers an audit. If any high-severity findings are detected, the PR is blocked until the issues are resolved. This prevents insecure configurations from reaching production.

Deep Dive

Run a security audit from the command line:

bash
# Basic audit
openclaw security audit

# Deep audit with auto-fix and JSON output
openclaw security audit --deep --fix --json

# Output:
# {
#   "findings": [
#     {
#       "severity": "high",
#       "rule": "no-api-auth",
#       "message": "API endpoint has no authentication configured",
#       "fix": "Added api.auth.required = true"
#     }
#   ],
#   "summary": {
#     "high": 1,
#     "medium": 0,
#     "low": 2,
#     "fixed": 1
#   }
# }

The --deep flag enables checks beyond basic configuration: it scans for outdated dependencies, overly permissive tool policies, and sandbox escape vectors. The --fix flag automatically applies safe corrections. The --json output is designed for CI/CD parsing.

Integrate the audit into a GitHub Actions workflow:

yaml
name: Security Audit
on:
  pull_request:
    paths:
      - '.openclaw/**'
      - 'openclaw.json'

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install OpenClaw
        run: curl -fsSL https://openclaw.ai/install.sh | bash
      - name: Run Security Audit
        run: |
          result=$(openclaw security audit --deep --json)
          high=$(echo $result | jq '.summary.high')
          if [ "$high" -gt 0 ]; then
            echo "::error::Security audit found $high high-severity issues"
            exit 1
          fi

This workflow runs on every PR that modifies OpenClaw configuration. It fails the check if any high-severity findings are detected.

Common Pitfalls

  1. Only running audits locally — Manual audits are easily forgotten. Automate them in CI/CD.
  2. Ignoring medium and low findings — Low-severity issues can compound into high-severity vulnerabilities over time.

Best Practices

  1. Block deployments on high-severity findings — Never deploy a configuration with unresolved high-severity audit findings.
  2. Run deep audits on a schedule — In addition to PR checks, run --deep audits nightly to catch issues from dependency updates.

Summary

  • openclaw security audit scans configuration for vulnerabilities and misconfigurations
  • The --deep flag enables thorough scanning including dependency checks
  • The --fix flag auto-corrects common issues, --json produces CI-friendly output
  • Integrate audits into CI/CD pipelines to catch issues before deployment
  • Block deployments on high-severity findings and run deep audits on a schedule
✓ Completed