# Security policy

## Reporting a vulnerability

**Please do not put details in a public issue.**

Open a report at
https://gitea.fanghe.it.com/zhenghy/u-claw/issues — mark it clearly as a
security report and keep the details minimal until we can arrange a private
channel.

> **This is a fork.** Upstream is `github.com/dongsheng123132/u-claw`. If the
> issue is in code we inherited unchanged, it affects their users too — please
> tell them as well. If it is in something this fork changed (the launcher, the
> i18n layer, the skill installer, the key-check endpoint, the self-heal
> routines), it is ours.
>
> We do not yet have a dedicated security address of our own. `origin.json`
> records that gap; until it is filled, the issue tracker is the route.

We will acknowledge within **3 working days** and give a first assessment within
**14 days**. Please give us a chance to fix it before disclosing publicly.

### What helps

- Which module — `portable/`, `install/`, `bootable/`
- Version or commit hash
- How it is triggered, and from where: local, LAN, or the internet
- Steps to reproduce, or a proof of concept
- What you think the fix looks like, if you have a view

## What is in scope

- Command injection, path traversal, arbitrary write or code execution in
  U-Claw's own scripts
- Injection through the loading or writing of `data/.openclaw/openclaw.json`
- Launchers (`START HERE - *`, `lib/start.mjs`) being hijacked through a
  malicious directory name or environment variable
- Man-in-the-middle exposure on the one-line install path
  (`curl | bash`, `irm | iex`)
- Privilege escalation in what the bootable USB scripts produce
- The key-check endpoint (`/api/test-key`) — it handles API keys server-side
- The diagnostics report leaking a secret it should have redacted

## What is not

- **Upstream dependencies** — Node.js, OpenClaw, Electron, Ventoy, Ubuntu.
  Report those to their projects; we track and upgrade versions.
- **A user publishing their own API key** in a screenshot or a public repo.
- **Physical access to the drive.** If someone has the drive, they have the
  data — that is the trade a portable product makes, and it is stated plainly
  in the README rather than defended against.
- **What an attacker can do once they already have admin or root** on the
  machine.

## Supported

| Module | Status |
|---|---|
| `portable/` | current `main` — reports accepted |
| `install/` | current `main` — reports accepted |
| `bootable/` | current `main` — reports accepted |
| `u-claw-app/` | **deprecated 2026-06-19**, no longer built or published |
| older tags | severity assessed, but no backported patches |

There are no stable version numbers yet; fixes go straight to `main`.

## Credit

Anyone who reports responsibly is credited in the fixing commit and the release
notes, unless you would rather not be.