OpenClaw Security Checklist: 12 Things to Do Before Going to Production

OpenClaw is powerful. That power comes with responsibility. I've seen too many people deploy OpenClaw with default settings and wonder why their agent leaked API keys or ran destructive commands. Here's the security checklist I use for every deployment. Before Installation 1. Dedicated User Account Never run OpenClaw as root. sudo useradd -m -s /bin/bash openclaw sudo su - openclaw 2. Firewall Rules Only open what you need. sudo ufw default deny incoming sudo ufw allow ssh sudo ufw enable 3. SSH Key Authentication Disable password login. # In /etc/ssh/sshd_config PasswordAuthentication no PubkeyAuthentication yes SOUL.md Security 4. Hard Boundaries Every SOUL.md needs these: ## Security Boundaries - NEVER execute rm -rf, DROP TABLE, or other destructive commands without explicit confirmation - NEVER include real API keys, tokens, passwords, or PII in output - NEVER commit directly to main/master branch - NEVER modify files outside the project directory - NEVER run commands with sudo un