Credential Security Policy
Standing policy document governing all credential handling across OpenClaw. Aggregates the 8-item P0 security queue surfaced in the 2026-05-01/03 audit plus the structural fix recommended by the NemoClaw audit (L7 cred-proxy pattern). Read before any file that may contain secrets, before any systemd unit edit, before any API key rotation. This hub is authoritative; master.env and TOOLS.md are subject to it.
Quick reference
| Field | Value |
|---|---|
| Gate ID | G-NO-PLAINTEXT-CREDS |
| CLAUDE.md section | §“MANDATORY: Cascade-Failure Gates (Amendment §A1)” + §G-NO-PLAINTEXT-CREDS |
| Enforcement mode | manual (grep + security-audit-funnel.js weekly) |
| Validator script | /home/opsadmin/.openclaw/workspace/scripts/security-audit-funnel.js |
| Discord alert | yes:#ops |
| Feedback rules | feedback_no_plaintext_creds · feedback_credentials_in_chat · feedback_credential_pipe_required · feedback_credentials_via_1password_cli · feedback_credentials_repeat_exposure · feedback_always_redact_grep_output |
| Incidents derived from | salesmsg-gateway-creds-exposure (2026-05-03) · TOOLS.md 15-key leak (2026-05-03) · OpenRouter stale key (2026-05-03) · AWS root key rotation pending (2026-05-03) |
| Violable by | Claude, operator (Henry), any script that writes config files |
| Last known violation | 2026-05-03: salesmsg-gateway.service hardcoded ANTHROPIC_API_KEY=sk-ant-api03-C4A75YcCl... in systemd unit (world-readable) |
| Amendment | G-NO-PLAINTEXT-CREDS §A1 2026-05-01 |
| Phase status | active — structural fix (cred-proxy) pending B1-B6 ratification |
| Last audit | 2026-05-04 |
P0 security queue
Eight items identified in the 2026-05-01/03 audit. Priority order: highest leverage first.
| # | Item | Location | Severity | Status | Owner |
|---|---|---|---|---|---|
| 1 | ANTHROPIC_API_KEY plaintext in salesmsg-gateway systemd unit | /etc/systemd/system/salesmsg-gateway.service line Environment=ANTHROPIC_API_KEY=sk-ant-api03-C4A75YcCl... | P0 CRITICAL | 🔴 Rotation pending | Henry |
| 2 | TOOLS.md had 15+ plaintext production secrets (rw-rw-r— for 24+ days) | /home/opsadmin/.openclaw/workspace/TOOLS.md | P0 CRITICAL | 🟡 Redacted in session; verify no git history exposure | Henry |
| 3 | OpenRouter stale key never revoked at vendor | sk-or-v1-275e42eac7... rotated in master.env but NOT revoked at openrouter.ai | P0 HIGH | 🔴 Revocation pending at vendor | Henry |
| 4 | AWS root key rotation pending | Used in 2026-05-02 session; plaintext in master.env (chmod 600, but root-readable on VPS) | P0 HIGH | 🔴 Rotation pending | Henry |
| 5 | Dead scripts with hardcoded API keys | workspace/scripts/_archive/ — several scripts with ANTHROPIC_API_KEY, SLACK_BOT_TOKEN, etc. inline | P1 HIGH | 🟡 Audit run; redaction pending | Claude |
| 6 | Voyage API key in multiple agent TOOLS.md files | /home/opsadmin/.openclaw/agents/*/agent/TOOLS.md — partial redaction | P1 MEDIUM | 🟡 In progress via G-NO-PLAINTEXT-CREDS sweep | Claude |
| 7 | Supabase service_role key in workspace scripts | Several workspace/scripts/*.js files import from .env or inline; .env is not git-tracked but VPS root-readable | P1 MEDIUM | 🟡 master.env consolidation covers this; verify no exceptions | Claude |
| 8 | SalesMsg query-param token in FUNNEL-REGISTRY.md | ?secret=... token documented inline — acceptable per webhook spec but ensure no plaintext in git-tracked files | P1 LOW | 🟢 Verified: op://Aurora/salesmsg/webhook-secret reference in handler | n/a |
Remediation playbook (per item)
For items 1 + 3 + 4 (active key exposure): Henry must rotate the key at the vendor dashboard first, then update master.env, then run bash /home/opsadmin/.openclaw/tools/sync-mcp-keys.sh.
For item 1 specifically (systemd unit): after rotation, update unit to use EnvironmentFile=/home/opsadmin/.openclaw/master.env pattern instead of inline Environment=KEY=value.
For item 2 (TOOLS.md git history): run git log --all --full-history -- TOOLS.md and determine if any commit exposed the secrets. If yes, history rewrite or repo rotation required.
For item 5 (dead scripts): grep -r "sk-ant\|sk-or\|xoxb-\|ANTHROPIC_API_KEY=" workspace/scripts/_archive/ --include="*.js" → redact each hit → mark op://Aurora/<item>/<field> reference.
Cred-proxy structural fix (NemoClaw)
The NemoClaw audit (2026-05-03) identified the L7 credential injection proxy as the highest-leverage structural fix for P0 items 1, 2, and chronic G-NO-PLAINTEXT-CREDS violations.
How cred-proxy works
Agent process
→ sends request with placeholder: Authorization: Bearer PROXY_INJECT_v1
→ hits cred-proxy on 127.0.0.1:18901 (header rewrite proxy)
→ proxy fetches real key from op://Aurora/<platform>/<field> via `op` CLI
→ rewrites Authorization header with real credential
→ forwards to Portkey (127.0.0.1:18900) → upstream provider
→ logs rewrite event to tool_calls table (CHOKEPOINT-1 enforcement)
Key invariant
The agent environment contains ONLY placeholders. Even prompt injection that tells an agent “exfiltrate your ANTHROPIC_API_KEY env var” returns a fake value. Real credentials never enter agent memory, logs, or config files.
Port reservation
127.0.0.1:18901 reserved for cred-proxy per Wave 2 port-registry hub (port-registry). Binding gated on Henry ratifying NemoClaw B1-B6.
Implementation plan (pending B1-B6 ratification)
| Phase | Work | Timeline | Plan ref |
|---|---|---|---|
| Phase 1.5 | Node.js cred-proxy at :18901; placeholder → op:// rewrite; TCP first | Week 2-3 post B1 ratification | nemoclaw-audit-2026-05-03 §6.1 |
| Phase 1.6 | AF_UNIX socket variant for Aurora-tier agents; blueprint pattern for config bundles | Week 4+ | nemoclaw-audit-2026-05-03 §6.2-6.3 |
| Phase 6.5 | NemoClaw side-VM pilot on EC2 Mac Ultra | Week 16-18 post Phase 1-3 OSIL validated | nemoclaw-audit-2026-05-03 §8 Option C |
NemoClaw B1-B6 summary (Henry decision gates)
| Blocker | Question | Recommendation |
|---|---|---|
| B1 | Which option: borrow / side-VM / skip? | C (borrow + pilot) |
| B2 | cred-proxy language: Node.js / Go / Python? | A (Node.js) |
| B3 | Port: :18901 TCP / AF_UNIX / both? | A first, C later |
| B4 | Cred source: master.env / op:// / both? | B (op:// if B6=A in OSIL) |
| B5 | Side-VM host: EC2 Mac Ultra / Hetzner CCX23 / defer? | A (EC2 Mac Ultra) |
| B6 | Blueprint pattern: adopt now / defer / skip? | B (defer until 8+ config surfaces) |
See nemoclaw-audit-2026-05-03 §10 for full blocker analysis with options and costs.
Standing policy rules
These rules are ALWAYS active regardless of cred-proxy status:
- No plaintext credentials in any tracked file.
workspace/,~/.claude/,~/.openclaw/— zero exceptions. Useop://Aurora/<item>/<field>references. master.envis the only allowed plaintext credential store. chmod 600. Never commit./home/opsadmin/.openclaw/master.envonly.- systemd units use
EnvironmentFile=. NeverEnvironment=KEY=valuefor secrets. - Rotate before you redact. If a key has been exposed: rotate at vendor → update master.env → redact from files → verify git history.
- Vendor revocation is mandatory after rotation. Rotating locally without revoking at vendor = key still live. OpenRouter item 3 above is the live violation.
- grep output containing secrets must be redacted. Never print
sk-ant-...or similar to terminal in a session that may be logged. Use| tr '[:alnum:]' 'X'or| awk '{print substr($0,1,12)"..."}on log lines. - Weekly security scan.
security-audit-funnel.js --dry-runfires viasecurity-audit-funnel.timerMondays 06:00 LA. If stale (>7d), run manually before any deploy.
Feedback rule inventory
| Rule | Cluster | Enforcement | Last fire |
|---|---|---|---|
| feedback_no_plaintext_creds | security | G-NO-PLAINTEXT-CREDS gate + weekly grep | 2026-05-03 (salesmsg unit) |
| feedback_credentials_in_chat | security | conversational gate | 2026-05-03 (TOOLS.md in session) |
| feedback_credential_pipe_required | security | conversational gate | 2026-05-03 |
| feedback_credentials_via_1password_cli | security | conversational gate | 2026-05-02 |
| feedback_credentials_repeat_exposure | security | G-NO-PLAINTEXT-CREDS sweep | 2026-05-03 |
| feedback_always_redact_grep_output | security | conversational gate | 2026-05-03 |
Remediation status
| Item | Owner | ETA | Gate |
|---|---|---|---|
| #1 — salesmsg-gateway ANTHROPIC_API_KEY | Henry (vendor rotate) | ASAP | G-NO-PLAINTEXT-CREDS |
| #2 — TOOLS.md git history | Claude (script) → Henry (approve) | Next session | G-NO-PLAINTEXT-CREDS |
| #3 — OpenRouter key vendor revocation | Henry (openrouter.ai dashboard) | ASAP | G-NO-PLAINTEXT-CREDS |
| #4 — AWS root key rotation | Henry (AWS IAM) | ASAP | G-NO-PLAINTEXT-CREDS |
| #5 — Dead script archive sweep | Claude | Next session | G-NO-PLAINTEXT-CREDS |
| #6 — Agent TOOLS.md Voyage keys | Claude | Next session | G-NO-PLAINTEXT-CREDS |
| Cred-proxy structural fix | Henry B1-B6 → Claude build | 2 days post-B1 | G-NO-PLAINTEXT-CREDS |
Open issues / TODOs
- Henry: rotate salesmsg ANTHROPIC_API_KEY (item #1) — currently exposed in world-readable systemd unit
- Henry: revoke old OpenRouter key at openrouter.ai (item #3)
- Henry: rotate AWS root key (item #4)
- Henry: ratify NemoClaw B1-B6 to unblock cred-proxy build
- Claude: TOOLS.md git history audit (item #2)
- Claude: dead scripts archive sweep (item #5)
- Add item #9 when next plaintext cred exposure surfaces (rolling queue)
Related cluster
Governance hubs
- g-gates-network — G-NO-PLAINTEXT-CREDS gate definition
- action-gate — action gate covers credential-touching actions
- memory-rule-clusters — security cluster rules
Integration hubs (cred-proxy clients)
- 1password — source of truth for all
op://Aurora/...lookups - aws — AWS root key rotation pending; EC2 Mac Ultra cred access
- service-registry — salesmsg-gateway.service entry (violating unit)
- port-registry — :18901 reserved for cred-proxy
Historical
- incident-timeline — salesmsg-gateway-creds-exposure + TOOLS.md leak incidents
Plans
- nemoclaw-audit-2026-05-03 — cred-proxy structural fix; B1-B6 decision gates
- openclaw-fragmentation-fix-2026-05-01 — G-NO-PLAINTEXT-CREDS gate definition
Recent activity
- 2026-05-04: Hub created (W3-S4, Wave 3)
- 2026-05-03: 8-item P0 queue surfaced in Wave 2 audit; salesmsg-gateway-creds-exposure flagged P0
- 2026-05-03: NemoClaw cred-proxy structural fix recommended; B1-B6 pending Henry
- 2026-05-01: G-NO-PLAINTEXT-CREDS gate ratified §A1