OpenClaw Security Checklist for Self-Hosted AI Assistants

A security-first guide for protecting OpenClaw deployments, based on the official docs around pairing, dashboard exposure, device auth, and safer account isolation.

OpenClaw can be safe, but only if you respect the fact that it touches real messaging surfaces, real credentials, and sometimes real browser automation. The official docs are clear: inbound DMs should be treated as untrusted input, the dashboard is an admin surface, and unsafe convenience flags should stay off unless you are deliberately debugging.

Quick answer

The safest OpenClaw setup is not the most permissive one. It is the one that keeps pairing on, isolates bot identities from personal identities, keeps the dashboard private, and treats the gateway like a real operational service instead of a demo app.

The official defaults are already trying to help you

The README and security docs both emphasize cautious defaults. On many channels, unknown senders get a pairing code instead of full access, and the docs repeatedly warn against exposing the dashboard publicly or disabling device auth casually.

Minimum security checklist

• Keep DM policy on pairing unless you have a very specific reason not to.
• Use separate bot accounts, phone numbers, or identities where possible instead of reusing your personal accounts.
• Reach the dashboard through localhost, Tailscale Serve, or SSH tunneling instead of a public open port.
• Store secrets intentionally and reduce auth sprawl across env vars, config files, auth profiles, and plugins.
• Run the built-in audit and repair flows as part of hardening, not only after something has already broken.

The unsafe patterns that cause most regret

• Opening DMs broadly before you understand pairing and allowlists.
• Letting the dashboard sit on a public URL because it felt convenient.
• Giving the assistant access to personal messages or personal identities before you have a clear approval model.
• Turning on insecure compatibility flags and then forgetting they were ever changed.

Questions to answer before you call it production

• Who can pair with the assistant and how is that approved?
• Which identities are bot-owned versus personally owned?
• Where do tokens, passwords, and provider credentials live today?
• Which actions should stay human-approved even after setup?
• How will you audit logs, sessions, and unexpected behavior later?

Why security becomes a buying signal

Security is one of the strongest commercial angles for OpenClaw support because buyers quickly discover that the hard part is not “Can I install it?” It is “Can I leave it running without creating a new operational risk?” That is the right point to bring in a stricter setup and review process.