How our check works
Exactly what we read, how we decide red, amber or green, where the data comes from, and what we don't check.
What we read
Only what you paste: the output of openclaw security audit (text or JSON), optionally openclaw --version (the audit doesn't include it; without it we skip the version checks), and optionally your openclaw.json. Your browser hides secret-looking values first, and we redact again on our side.
How we decide red, amber or green
- Red: at least one critical or high finding, such as a gateway reachable without auth or a version with a known token-theft bug.
- Amber: medium findings, such as plain-text keys or no hard spend limits.
- Green: no issues found in the checks we ran. Only when the check is complete: a
--deepaudit, a version, and output we could parse.
If anything is missing, the result is never green, and the paid report stays closed until it's complete.
Where our version data comes from
Public sources: OpenClaw's own release notes and GitHub security advisories, and the OSV database. Ruleset version 2026-10-18.2. Each result records the time in UTC and the ruleset used.
What we don't check
- The computer or server your agent runs on
- Prompt injection and what your agent does with your data
- Skill source code
- Anything after the moment we looked
It's not a penetration test, code review or certification. Limits of the check.
Aggregate statistics
We may publish anonymized aggregate figures (for example, the share of free checks with an exposed gateway). We never publish anything about an individual agent, host or person, and we don't publish a percentage based on fewer than 100 checks. Privacy policy.
Check your own setup
Paste your audit and get a plain-English result in minutes. Look-only, point-in-time, and never "green" unless the check finished.