Security Layers

Security is foundational to Clawdy. Every instance is protected by multiple overlapping security layers, ensuring your code, data, and running applications stay private.

The 8-Layer Security Model

Clawdy implements defense in depth with eight distinct security layers:

1. Loopback Binding

By default, OpenClaw only listens on 127.0.0.1 (localhost). This means:

• The AI agent is not directly accessible from the internet
• All access must go through Clawdy's authenticated proxy
• Even if other security layers fail, the service isn't exposed

# OpenClaw binds to localhost only
openclaw --host 127.0.0.1 --port 7860

2. Auth Code Validation

Every instance has a unique, randomly generated auth code. This code:

• Is created during provisioning and stored securely
• Must match on every request to the instance
• Is never exposed to users (handled by the proxy)
• Can be rotated if compromised

3. SSH Hardening

SSH access to your instance follows security best practices:

• Key-only authentication: Password login is disabled
• Root login disabled: Must use the clawdy user
• Non-standard port: SSH runs on a randomized high port
• Fail2ban integration: Automatic IP blocking after failed attempts

# SSH config on your instance
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

4. Fail2ban Protection

Fail2ban monitors for malicious activity and automatically blocks attackers:

• Blocks IPs after repeated failed SSH attempts
• Blocks IPs showing suspicious HTTP patterns
• Ban duration increases with repeat offenses
• Whitelist support for your known IPs

5. UFW Firewall

Ubuntu's Uncomplicated Firewall (UFW) restricts network access:

# Default policy: deny all incoming
ufw default deny incoming
ufw default allow outgoing

# Only allow specific ports
ufw allow 22/tcp      # SSH (or custom port)
ufw allow 443/tcp     # HTTPS via proxy

All other ports are blocked at the firewall level, even if a service is accidentally started.

6. Cloudflare Protection

All traffic flows through Cloudflare, providing:

• DDoS protection: Automatic mitigation of volumetric attacks
• WAF rules: Block common attack patterns
• SSL/TLS: End-to-end encryption
• Bot protection: Filter malicious automated traffic
• Rate limiting: Prevent abuse

7. API Key Isolation

Each instance operates with isolated credentials:

• OpenRouter API keys are per-user
• Instance API keys are per-instance
• Keys can be rotated independently
• Compromised keys don't affect other users

8. Dedicated User

OpenClaw runs under a dedicated clawdy user with:

• Limited filesystem permissions
• No sudo access by default
• Isolated home directory
• Restricted process capabilities

Security in Practice

When You Access Your Instance

You → Cloudflare → Auth Proxy → UFW → OpenClaw
         ↓            ↓
      DDoS/WAF    Session Check
      Protection  + Auth Code

When Someone Tries to Attack

Attacker → Cloudflare → [BLOCKED by WAF/Rate Limit]
                or
Attacker → Instance IP → [BLOCKED by UFW]
                or
Attacker → SSH → [BLOCKED by Fail2ban]

What You Don't Need to Do

Because of these security layers, you don't need to:

Reporting Security Issues

If you discover a security vulnerability in Clawdy:

1. Do not disclose it publicly
2. Email security@clawdy.app with details
3. We'll respond within 24 hours
4. We'll work with you on responsible disclosure

Next Steps

• Quick Start: Get your secure instance running
• Auth-Protected Apps: Access your apps securely