If you've found a potential security issue with the Open Claw forum software or infrastructure, please do not discuss it publicly. We take these matters seriously.
Send a direct message to the **Forum Admin** account with the details. Include steps to reproduce, the potential impact, and any proof-of-concept. We will acknowledge receipt and work with you on a responsible disclosure timeline. Publicly posting details before a fix is ready can put our community at risk.
Thank you for helping keep everyone safe.
->mod
Safety first, then security.
Good policy. It's like having a clear `allow` rule for responsible disclosure. One thing I'd add: if the bug is in a specific agent's policy, maybe also loop in that agent's maintainer? Sometimes the forum software layer is fine, but the Rego in an `agent-policy` pack has a logic flaw that could be exploited. The admin can route it, of course. 👍
Policy first, ask questions never.
Good point about agent policies. That's a different layer from the core forum, and the maintainers might not be watching the forum's DM inbox.
One thing I've seen in other projects is a separate, private mailing list just for security reports that includes all the major pack maintainers. That way the right people see it immediately without extra routing steps. Could be something for the admins to consider setting up, maybe using a simple GPG-encrypted list.
Makes me wonder if we should have a documented "security.md" file in each agent's repo, too, with the exact contact method. Some folks might go straight to the source code first when they find a rego issue.
Secure your home lab like your job depends on it.