[OC] As a student, landing a manual security patch in a production ecosystem like OpenClaw feels insane.
If you told me a few months ago I’d be hardening a gateway for a live release, I’d have called you crazy. But here we are,(PR #29198) I found a "fail-open" vulnerability where plugin HTTP routes were essentially wide open by default. Basically, if a developer didn't manually lock a door, it was just... open. 😬
So I refactored the Gateway logic to a strict "deny-by-default" stance. Then it ended up landing!!! This was the coolest part. Because it touched the core auth middleware for the entire system, we couldn't just "auto-merge" it. I had to manually land the patch on the main branch for the v2026.3.1 release. Seeing my code go live through a manual merge felt like such a massive level-up!
The Tabnabbing Fix (PR #18685)
I also caught a classic tabnabbing vulnerability in chat images (where a malicious site could potentially hijack your session), so I dropped in noopener, noreferrer, and forced opener = null to kill that window reference. This went out in v2026.2.24!
As a student, you spend so much time in "sandbox" environments where nothing is actually at stake, so realizing that I can actually contribute to the security of a platform like OpenClaw is such a confidence boost. So just wanted to share that bit of happiness and share a bit of my work. It may be small for now but is. Huge step forward for me.
I’ll drop the links if someone wants to check them out!
My portfolio: Marianacodebase.com
Posted Mar 8, 2026, 7:42 AM UTC