Hardening OpenClaw self-hosting: localhost-first + token auth + deny-by-default (code)

Hey folks — quick security + debugging angle for anyone self-hosting OpenClaw.

Bitsight wrote they found 30k+ OpenClaw instances exposed on the public internet. [1]

(Also saw writeups referencing Censys scans / “bind to all interfaces” defaults.) [2]

Even if you’re careful, the lesson seems consistent: once an LLM can call system-level tools,

the tool/execution layer is a big part of the attack surface — and it’s where debugging hurts

(“what did the agent actually do?”).

I put together a small adapter (not trying to replace OpenClaw — just harden/observe tool runs):

https://github.com/flytohub/flyto-openclaw

What it adds:

- evidence snapshots per step

- step-by-step replay (reproduce failures, inspect what happened)

Hardening defaults (practical, not perfect):

- localhost-first networking (configurable)

- bearer-token auth (per-user token file, 0600 perms)

- deny-by-default for high-risk tool families + optional allowlist mode

Posting mainly for feedback:

- What “safe-by-default” settings do you expect for OpenClaw self-host?

- Would you prefer allowlist-only by default (breaking), or denylist as a pragmatic default?

- Any gotchas you’ve hit (CORS, auth, bind address, reverse proxies, etc.)?

If useful, I can add a minimal “30s quickstart” + a short demo task showing evidence/replay.

[1] https://www.bitsight.com/blog/openclaw-ai-security-risks-exposed-instances

[2] https://thehackernews.com/2026/02/openclaw-integrates-virustotal-scanning.html