The OpenClaw Lockdown

The 15-step config-by-config hardening pass. Patches, loopback bind, 256-bit token, Docker sandbox, tool allowlists, Ollama defense, and the credential rotation plan.

• The full 15-step hardening pass from patch baseline through firewall, sandbox, channel allowlists, and Ollama as defense layer
• Real openclaw.json blocks for tool deny-by-default, credential secretRefs, Docker socket safety, and the 256-bit gateway token
• Skill audit decision rubric, credential rotation cadence, KQL hunting queries, and the rebuild trigger when persistence is suspected