Security

Last updated: May 31, 2026

Installer verification

The installer downloads a platform binary and verifies its SHA-256 checksum from the release metadata before installing. Review install.sh before running it, especially when using a shell pipeline.

Runtime security model

GoClaw includes gateway token authentication, rate limiting, path sandboxing, shell allow/deny lists, outbound HTTP policy controls, SSRF protection, role-based memory writes, and local secret storage. These controls depend on correct operator configuration.

Operator checklist

• Set a strong gateway auth token before exposing the Web UI or API.
• Keep the default loopback bind unless you intentionally expose the gateway.
• Use narrow shell and HTTP allowlists.
• Do not store provider keys, database credentials, or private files in public workspaces.
• Review every connected tool, MCP server, channel, and webhook before production use.

Vulnerability disclosure

Please report security issues privately to: security@ulab.mn. Include affected version, configuration assumptions, reproduction steps, and impact.