OpenClaw security checklist

• Bind the gateway to 127.0.0.1 unless you have reverse proxy + auth.
• Never expose the Control UI to the public internet without TLS and a token.
• Approve chat senders explicitly; do not auto-pair strangers.
• Store API keys in local env, not in git.
• Run a security audit after every upgrade.