secrets-hygiene-openclaw

name

secrets-hygiene-openclaw

description

Audit and harden secret handling for OpenClaw configuration and workspace files, including detection of exposed keys/tokens, file-permission tightening, rotation planning, and post-fix verification. Use when secrets may be hardcoded in openclaw.json, auth-profiles, .env files, or scripts; before publishing/sharing workspace content; after suspected token leakage; or during routine security maintenance.

Secrets Hygiene OpenClaw

Overview

Detect risky secret exposure patterns without printing raw secret values. Apply safe hardening steps and generate a rotation plan with verification commands.

Quick Start

1. Scan for possible exposures:

   ./scripts/secret_scan.sh
   

2. Tighten sensitive file permissions:

   ./scripts/secret_permissions_fix.sh
   

3. Generate a rotation checklist:

   ./scripts/secret_rotation_plan.sh > /tmp/secret-rotation.md
   

4. Run post-fix verification:

   ./scripts/security_postcheck.sh
   

Workflow

Step 1: Scope the scan

• Prefer scanning OpenClaw state directory and workspace.
• Add additional paths only when needed.
• Never include giant cache/log directories in the first pass.

Step 2: Detect exposures without leaking values

• Run secret_scan.sh.
• Use key-name and location signals only (file, line, key name).
• Do not echo full token values in chat output.

Step 3: Classify and prioritize

• High: token, secret, private_key, refresh, access.
• Medium: api_key, password.
• Treat config in shared repos as higher risk than local-only files.

Step 4: Harden file permissions

• Run secret_permissions_fix.sh on OpenClaw state/config paths.
• Apply least privilege:
  • sensitive files: 600
  • sensitive dirs: 700
• Re-run scan after permission fixes.

Step 5: Plan and execute rotation

• Generate checklist via secret_rotation_plan.sh.
• Rotate highest-risk credentials first:
  1. gateway/channel tokens
  2. provider API keys
  3. OAuth refresh/access credentials
• After each rotation, validate service behavior.

Step 6: Verify post-rotation security and runtime

• Run security_postcheck.sh.
• Confirm:
  • openclaw security audit returns no critical findings
  • config validation passes
  • channels/workflows still operate

Guardrails

• Do not paste raw secrets in user-visible responses.
• Do not commit real tokens to Git.
• Prefer env variables or secret references over plaintext in config.
• Back up before mass edits.

Resources

• scripts/secret_scan.sh: Scan likely secret exposures and print redacted findings.
• scripts/secret_permissions_fix.sh: Tighten permissions on sensitive files/dirs.
• scripts/secret_rotation_plan.sh: Generate markdown rotation checklist from findings.
• scripts/security_postcheck.sh: Run OpenClaw security/config validation checks.
• references/secrets-policy.md: Policy and remediation guidance.

Example Requests

1. "Audit secret hygiene cho OpenClaw config và workspace, không in token thật."
2. "Tạo checklist rotate secret theo mức độ ưu tiên."
3. "Hardening file permissions cho các file nhạy cảm rồi verify lại."