http://tardigrde.github.io/openclaw-deploy/security/Recent content in Security on OpenClaw DeployHugoenhttp://tardigrde.github.io/openclaw-deploy/security/hardening/Mon, 01 Jan 0001 00:00:00 +0000http://tardigrde.github.io/openclaw-deploy/security/hardening/<h1 id="security-hardening">Security Hardening</h1> <p>Overview of all security controls applied to the OpenClaw VPS.</p> <h2 id="firewall">Firewall</h2> <p>Two firewall layers run in series.</p> <h3 id="hetzner-cloud-firewall-network-level">Hetzner Cloud Firewall (network-level)</h3> <p>Managed in Terraform (<code>terraform/modules/hetzner-vps/main.tf</code>). Applied at the hypervisor — traffic is dropped before it reaches the OS.</p> <table> <thead> <tr> <th>Direction</th> <th>Protocol</th> <th>Port</th> <th>Source</th> <th>Condition</th> </tr> </thead> <tbody> <tr> <td>Inbound</td> <td>TCP</td> <td>22</td> <td><code>ssh_allowed_cidrs</code> variable</td> <td>Always</td> </tr> <tr> <td>Inbound</td> <td>UDP</td> <td>41641</td> <td><code>0.0.0.0/0</code>, <code>::/0</code></td> <td>Only if Tailscale on</td> </tr> <tr> <td>Outbound</td> <td>TCP</td> <td>1–65535</td> <td><code>0.0.0.0/0</code>, <code>::/0</code></td> <td>Always</td> </tr> <tr> <td>Outbound</td> <td>UDP</td> <td>1–65535</td> <td><code>0.0.0.0/0</code>, <code>::/0</code></td> <td>Always</td> </tr> <tr> <td>Outbound</td> <td>ICMP</td> <td>—</td> <td><code>0.0.0.0/0</code>, <code>::/0</code></td> <td>Always</td> </tr> </tbody> </table> <p><code>ssh_allowed_cidrs</code> defaults to <code>[&quot;0.0.0.0/0&quot;]</code>. For tighter access, set it to specific IPs in <code>secrets/inputs.sh</code>, or set it to <code>[]</code> to block public SSH entirely (Tailscale-only mode).</p>http://tardigrde.github.io/openclaw-deploy/security/policy/Mon, 01 Jan 0001 00:00:00 +0000http://tardigrde.github.io/openclaw-deploy/security/policy/<h1 id="security-policy">Security Policy</h1> <h2 id="reporting-a-vulnerability">Reporting a Vulnerability</h2> <p>If you discover a security vulnerability in this project, please report it responsibly:</p> <ol> <li><strong>Do NOT</strong> open a public GitHub issue</li> <li>Use <a href="../../security/advisories/new">GitHub Security Advisories</a> to report vulnerabilities privately</li> <li>Include: <ul> <li>Description of the vulnerability</li> <li>Steps to reproduce</li> <li>Potential impact</li> <li>Suggested fix (if you have one)</li> </ul> </li> </ol> <p>We aim to respond to security reports within 48 hours and will work with you to understand and address the issue.</p> <h2 id="supported-versions">Supported Versions</h2> <table> <thead> <tr> <th>Version</th> <th>Supported</th> </tr> </thead> <tbody> <tr> <td>main</td> <td>:white_check_mark:</td> </tr> <tr> <td>&lt; 1.0</td> <td>:x:</td> </tr> </tbody> </table> <h2 id="security-considerations">Security Considerations</h2> <h3 id="infrastructure-security">Infrastructure Security</h3> <p>This project deploys cloud infrastructure. Please be aware of:</p>