zeekay
4bdc9ee3e4
Comprehensive rename of all openclaw references to hanzo-bot equivalents: - Package: openclaw → @hanzo/bot - Binary: openclaw → hanzo-bot - Types: OpenClaw* → Bot* - Env vars: OPENCLAW_* → BOT_* - Android: ai.openclaw.android → ai.hanzo.bot.android - iOS/macOS: ai.openclaw.* → ai.hanzo.* - Swift modules: OpenClaw* → Bot* - Plugins: openclaw.plugin.json → bot.plugin.json - Paths: .openclaw/ → .hanzo/bot/ - URLs: github.com/openclaw → github.com/hanzoai
1.3 KiB
summary, read_when, title
| summary | read_when | title | ||
|---|---|---|---|---|
| CLI reference for `hanzo-bot security` (audit and fix common security footguns) |
|
security |
hanzo-bot security
Security tools (audit + optional fixes).
Related:
- Security guide: Security
Audit
hanzo-bot security audit
hanzo-bot security audit --deep
hanzo-bot security audit --fix
The audit warns when multiple DM senders share the main session and recommends secure DM mode: session.dmScope="per-channel-peer" (or per-account-channel-peer for multi-account channels) for shared inboxes.
It also warns when small models (<=300B) are used without sandboxing and with web/browser tools enabled.
For webhook ingress, it warns when hooks.defaultSessionKey is unset, when request sessionKey overrides are enabled, and when overrides are enabled without hooks.allowedSessionKeyPrefixes.
It also warns when sandbox Docker settings are configured while sandbox mode is off, when gateway.nodes.denyCommands uses ineffective pattern-like/unknown entries, when global tools.profile="minimal" is overridden by agent tool profiles, and when installed extension plugin tools may be reachable under permissive tool policy.