zheng
3221856d50
Some checks failed
Tests / test (push) Has been cancelled
不是翻译 —— 多数文档描述的行为已经不存在了。 先修一个更基本的问题：我们不拥有 u-claw.org 域名，那是上游的。所以之前写在 README、诊断包提示、联系方式里的 help@u-claw.org 全都会把用户的问题发给 上游 —— 一个没有理由回复的人。改为指向我们自己的 issue tracker，并加断言 禁止再出现指向该域名的支持入口。 重写（内容过时，不是语言问题）： - install/README.md —— 还写着 10 个中国技能、DeepSeek 优先、国内镜像。 现在按实际流程写：技能读 manifest、模型菜单 Gemini 优先、bundle 有 SHA256 校验。并如实写明 curl|bash 在受管企业电脑上会被 EDR 拦。 - CLAUDE.md 的模型配置整节 —— 还在描述虾盘云首选卡片和 12 个 provider， 那个界面已经换成单框 Key 输入了。 - SECURITY.md —— 安全报告原本指向上游维护者个人邮箱。fork 之后那条路由 是错的：漏洞会发给写不了这份代码、也修不了的人。 - CONTRIBUTING.md —— 补上 fork 关系、pre-push 钩子怎么装、以及 `node --test tests/` 为什么不能用。 翻译并保留： - bootable/README.md、TROUBLESHOOTING.md —— 面向用户，顺带把 「国内镜像」「小米/华为 BIOS 按键」等换成目标市场的实际情况 HANDOFF.md 重写为一份事故复盘：原文一半是过时的一次性交接笔记（引用的 website/guide.html 已不在本仓库），另一半是 persistence.dat 未格式化导致 启动失败的排查记录 —— 后者有长期价值，尤其是「读 offset 1080 的两字节 验证 ext4」这个判断方法，已同时写进 bootable/README.md。 bootable/IMPROVEMENTS_SUMMARY.md 保留中文，加了说明：它是上游 fork 前的 历史改进记录，没人引用，描述的是已完成的工作而非当前行为。翻译它反而会 让人误以为是现行文档。 新增 skills/en/uclaw-help —— 把「怎么用、东西在哪、出问题怎么办」做成 内置知识，每个角色都装。方案 C10.8：能问的产品才是不需要学的产品。
72 lines
2.8 KiB
Markdown
72 lines
2.8 KiB
Markdown
# Security policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not put details in a public issue.**
|
|
|
|
Open a report at
|
|
https://gitea.fanghe.it.com/zhenghy/u-claw/issues — mark it clearly as a
|
|
security report and keep the details minimal until we can arrange a private
|
|
channel.
|
|
|
|
> **This is a fork.** Upstream is `github.com/dongsheng123132/u-claw`. If the
|
|
> issue is in code we inherited unchanged, it affects their users too — please
|
|
> tell them as well. If it is in something this fork changed (the launcher, the
|
|
> i18n layer, the skill installer, the key-check endpoint, the self-heal
|
|
> routines), it is ours.
|
|
>
|
|
> We do not yet have a dedicated security address of our own. `origin.json`
|
|
> records that gap; until it is filled, the issue tracker is the route.
|
|
|
|
We will acknowledge within **3 working days** and give a first assessment within
|
|
**14 days**. Please give us a chance to fix it before disclosing publicly.
|
|
|
|
### What helps
|
|
|
|
- Which module — `portable/`, `install/`, `bootable/`
|
|
- Version or commit hash
|
|
- How it is triggered, and from where: local, LAN, or the internet
|
|
- Steps to reproduce, or a proof of concept
|
|
- What you think the fix looks like, if you have a view
|
|
|
|
## What is in scope
|
|
|
|
- Command injection, path traversal, arbitrary write or code execution in
|
|
U-Claw's own scripts
|
|
- Injection through the loading or writing of `data/.openclaw/openclaw.json`
|
|
- Launchers (`START HERE - *`, `lib/start.mjs`) being hijacked through a
|
|
malicious directory name or environment variable
|
|
- Man-in-the-middle exposure on the one-line install path
|
|
(`curl | bash`, `irm | iex`)
|
|
- Privilege escalation in what the bootable USB scripts produce
|
|
- The key-check endpoint (`/api/test-key`) — it handles API keys server-side
|
|
- The diagnostics report leaking a secret it should have redacted
|
|
|
|
## What is not
|
|
|
|
- **Upstream dependencies** — Node.js, OpenClaw, Electron, Ventoy, Ubuntu.
|
|
Report those to their projects; we track and upgrade versions.
|
|
- **A user publishing their own API key** in a screenshot or a public repo.
|
|
- **Physical access to the drive.** If someone has the drive, they have the
|
|
data — that is the trade a portable product makes, and it is stated plainly
|
|
in the README rather than defended against.
|
|
- **What an attacker can do once they already have admin or root** on the
|
|
machine.
|
|
|
|
## Supported
|
|
|
|
| Module | Status |
|
|
|---|---|
|
|
| `portable/` | current `main` — reports accepted |
|
|
| `install/` | current `main` — reports accepted |
|
|
| `bootable/` | current `main` — reports accepted |
|
|
| `u-claw-app/` | **deprecated 2026-06-19**, no longer built or published |
|
|
| older tags | severity assessed, but no backported patches |
|
|
|
|
There are no stable version numbers yet; fixes go straight to `main`.
|
|
|
|
## Credit
|
|
|
|
Anyone who reports responsibly is credited in the fixing commit and the release
|
|
notes, unless you would rather not be.
|