<!-- source: https://deepwiki.com/openclaw/openclaw/7.1-security-model-and-trust-boundaries -->

# Security Model & Trust Boundaries

- .agents/skills/telegram-crabbox-e2e-proof/SKILL.md
- .github/actions/docker-e2e-plan/action.yml
- .github/codex/prompts/mantis-telegram-desktop-proof.md
- .github/workflows/auto-response.yml
- .github/workflows/clawsweeper-dispatch.yml
- .github/workflows/dependency-guard.yml
- .github/workflows/full-release-validation.yml
- .github/workflows/mantis-discord-smoke.yml
- .github/workflows/mantis-discord-status-reactions.yml
- .github/workflows/mantis-discord-thread-attachment.yml
- .github/workflows/mantis-slack-desktop-smoke.yml
- .github/workflows/mantis-telegram-desktop-proof.yml
- .github/workflows/mantis-telegram-live.yml
- .github/workflows/npm-telegram-beta-e2e.yml
- .github/workflows/openclaw-live-and-e2e-checks-reusable.yml
- .github/workflows/openclaw-release-checks.yml
- .github/workflows/opengrep-precise-full.yml
- .github/workflows/opengrep-precise.yml
- .github/workflows/package-acceptance.yml
- .github/workflows/qa-live-transports-convex.yml
- .github/workflows/real-behavior-proof.yml
- .github/workflows/sandbox-common-smoke.yml
- scripts/check-extension-package-tsc-boundary.mjs
- scripts/check-memory-fd-repro.mjs
- scripts/e2e/openwebui-docker.sh
- scripts/e2e/telegram-user-crabbox-proof.ts
- scripts/e2e/telegram-user-driver.py
- scripts/github/barnacle-auto-response.mjs
- scripts/github/dependency-guard.mjs
- scripts/github/real-behavior-proof-check.mjs
- scripts/github/real-behavior-proof-policy.mjs
- scripts/lib/docker-e2e-plan.mjs
- scripts/lib/docker-e2e-scenarios.mjs
- scripts/list-prod-store-packages.mjs
- src/cli/cron-cli/register.cron-add.ts
- src/cli/cron-cli/schedule-options.ts
- src/gateway/session-utils.perf.test.ts
- test/scripts/barnacle-auto-response.test.ts
- test/scripts/check-extension-package-tsc-boundary.test.ts
- test/scripts/check-memory-fd-repro.test.ts
- test/scripts/dependency-guard-script.test.ts
- test/scripts/dependency-guard-workflow.test.ts
- test/scripts/docker-e2e-plan.test.ts
- test/scripts/list-prod-store-packages.test.ts
- test/scripts/mantis-telegram-desktop-proof-workflow.test.ts
- test/scripts/real-behavior-proof-check.test.ts
- test/scripts/real-behavior-proof-policy.test.ts
- test/scripts/sandbox-common-smoke-workflow.test.ts

This page documents OpenClaw's security model, threat assumptions, and trust boundaries. It explains the single trusted operator security model, key threat assumptions, in-scope and out-of-scope security guarantees, and defense-in-depth mechanisms including static analysis, plugin supply chain hardening, sandboxing, SSRF protection, and code quality gates.

## Trust Model Overview

OpenClaw assumes a **personal assistant security model** with a single trusted operator boundary per Gateway instance. It is **not** designed as a multi-tenant adversarial isolation system where untrusted or adversarial users share one gateway configuration or agent runtime.

This establishes that the trusted boundary starts at the operator who controls Gateway config and API keys. All runtime extensions and agents run within that boundary. Incoming messages and external network inputs are untrusted and strictly validated or sandboxed as needed.

### Trust Boundary Diagram: Concepts to Code Entities

```

```

**Sources:** [scripts/e2e/telegram-user-crabbox-proof.ts153-157](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/e2e/telegram-user-crabbox-proof.ts#L153-L157) [scripts/github/real-behavior-proof-policy.mjs122-133](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/github/real-behavior-proof-policy.mjs#L122-L133) [scripts/check-memory-fd-repro.mjs29-31](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/check-memory-fd-repro.mjs#L29-L31) [scripts/lib/docker-e2e-scenarios.mjs179-193](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/lib/docker-e2e-scenarios.mjs#L179-L193)

## Trust Boundary Definitions

### Operator Trust Boundary

The trusted operator boundary is defined as the person or process that can:

- Modify the Gateway host configuration files ( openclaw.json and related state).
- Authenticate to the Gateway API with valid tokens or credentials.

#### Key points:

- Gateway access controls grant operator-level permissions to all authenticated callers.
- Secrets used by plugins and agents are resolved via the SecretRef system, ensuring credentials are handled via environment variables or secure storage scripts/github/real-behavior-proof-policy.mjs 169-180
- Model transport data is sanitized to prevent leaking sensitive request identifiers or internal metadata scripts/check-memory-fd-repro.mjs 32-44

### Supply Chain Hardening & Plugin Installation

OpenClaw enforces a robust supply-chain security process:

- Static Analysis Enforcement: OpenGrep rules are used to maintain boundaries between core logic and extension surfaces .github/workflows/opengrep-precise.yml 1-20
- Dependency Auditing: The project uses Knip for dependency auditing and ensures critical quality gates are met during CI .github/workflows/mantis-telegram-desktop-proof.yml 48-49
- Isolated Proof Environments: For PR verification, Mantis creates detached worktrees to isolate baseline and candidate builds, ensuring untrusted fork code cannot access main workflow secrets .github/codex/prompts/mantis-telegram-desktop-proof.md 104-113

## Model Transport & SSRF Guard

OpenClaw processes all outbound network requests through a guard system that mitigates SSRF (Server-Side Request Forgery).

- readBoundedGitHubApiJson : This function wraps API requests with security policies, including size limits and timeout guards to prevent resource exhaustion scripts/github/real-behavior-proof-policy.mjs 122-133
- Private Network Control : Requests to private or local networks are restricted during agent execution to prevent internal service probing scripts/check-memory-fd-repro.mjs 32-44
- Bounded Response Reading : All network responses are consumed through bounded readers to prevent memory-based Denial of Service (DoS) attacks scripts/github/real-behavior-proof-policy.mjs 128-131

## Static Analysis & Quality Gates

OpenClaw employs automated static analysis and quality assurance mechanisms to maintain code security.

### OpenGrep Security Rulepack

- OpenGrep runs static analysis over the codebase to flag unapproved patterns and enforce precise boundaries between core and extensions .github/workflows/opengrep-precise.yml 1-20
- Full repository scans are performed periodically to ensure compliance with security policies .github/workflows/opengrep-precise-full.yml 1-15

### CodeQL Security & Quality Gates

- The CI pipeline integrates CodeQL critical quality gates to detect potential vulnerabilities like injection or memory safety issues.
- These gates are mandatory for all PRs and releases to ensure a high security baseline .github/workflows/full-release-validation.yml 180-184

### Mantis Visual Proofing

Mantis provides an additional layer of security by verifying that code changes do not introduce visual regressions or unexpected behavior in real messaging environments like Telegram. This process includes mandatory authorization checks for workflow actors [scripts/e2e/telegram-user-crabbox-proof.ts1-83](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/e2e/telegram-user-crabbox-proof.ts#L1-L83) [.github/workflows/mantis-telegram-desktop-proof.yml56-80](https://github.com/openclaw/openclaw/blob/fbdf5937/.github/workflows/mantis-telegram-desktop-proof.yml#L56-L80)

## Model Request Security Flow

```

```

**Sources:** [scripts/github/real-behavior-proof-policy.mjs100-133](https://github.com/openclaw/openclaw/blob/fbdf5937/scripts/github/real-behavior-proof-policy.mjs#L100-L133) [.github/codex/prompts/mantis-telegram-desktop-proof.md43-55](https://github.com/openclaw/openclaw/blob/fbdf5937/.github/codex/prompts/mantis-telegram-desktop-proof.md?plain=1#L43-L55)

## Out of Scope & Known Limitations

- Model Hallucinations: Incorrect LLM output is not a security failure unless it leads to SSRF guard bypass or unauthorized tool execution.
- Operator Actions: The trusted operator can configure agents with tools that access filesystem resources directly; OpenClaw assumes the operator intends this access.
- External API Security: OpenClaw relies on the security of third-party model providers (OpenAI, Anthropic, etc.). Compromise of a provider's API key is outside OpenClaw's technical control boundary.

**Sources:**

- .github/workflows/mantis-telegram-desktop-proof.yml 56-108
- scripts/github/real-behavior-proof-policy.mjs 1-133
- scripts/e2e/telegram-user-crabbox-proof.ts 145-170
- .github/codex/prompts/mantis-telegram-desktop-proof.md 9-28
- .github/workflows/opengrep-precise.yml 1-20
