OpenClaw is a powerful tool with extensive capabilities. When exposing it to a network, security is paramount.
- Never Expose Port 18789 Directly: The dashboard and gateway are unauthenticated by default in this setup. Exposing this port to the public internet without a secure tunnel or reverse proxy is a major security risk.
- Use HTTPS Tunnels: For remote access, we recommend using Cloudflare Tunnel or [Localtonet]. Always ensure the connection is encrypted.
- API Key Security: Keep your
.envfile secure. Never commit it to a repository. - Permissions: The
openclaw_datadirectory contains sensitive configuration and session data. Ensure its permissions are restrictive (700or755).
| Feature | Development (Host Mode) | Production (Remote/Tunnel) |
|---|---|---|
| Network | network_mode: host |
bridge (Explicit ports) |
| SSL | Bypassed (NODE_TLS...) | Mandatory (Via Tunnel/Proxy) |
| Auth | Bypass (Optional) | Required |
| Access | localhost only |
Encrypted Tunnel |
If you find a security issue in this deployment setup, please open an issue on the repository. For vulnerabilities in the OpenClaw application itself, refer to the official OpenClaw repository.