Security
Last updated: July 23, 2026
This page lists the concrete security controls VibeOpenClaw runs today. We'd rather list six things that are actually true than a longer list that isn't.
Controls in place
Keys encrypted at rest
Model-provider API keys you add are encrypted at rest with AES-256-GCM before being stored.
Per-agent Docker isolation
Every agent runs in its own Docker container, separate from other users’ agents and from the host.
Hashed passwords
Account passwords are hashed with bcrypt (cost factor 12) — we never store or can recover your plaintext password.
HTTPS everywhere
All traffic to the app and to your agent’s public endpoint is served over HTTPS.
Token-based sessions
Sign-in uses signed JWT session tokens rather than server-side session state.
True BYOK
You bring your own model-provider keys. We route your agent’s requests to your provider — we don’t proxy, log, or mark up your inference traffic.
Responsible disclosure
If you find a security issue, we want to know. Email security@vibeopenclaw.com with details and, if possible, steps to reproduce. We'll respond and work with you on a fix before any public disclosure.