SECURITY / TRUST
Fail closed. Preserve evidence.
GoClaw treats models and Skills as unprivileged proposers. Workspace, RBAC, Policy, Approval, Quota, and Audit are enforced by the control plane.
Credential protection
Provider keys use field-bound AES-256-GCM envelope encryption; plaintext is excluded from API responses, logs, images, and Git.
Responsible disclosure
Do not submit tokens, user data, or exploitable detail in public issues. Report privately through the repository Security Advisory with affected versions and reproduction conditions.