5 ms·

Only if your openclaw instance is publicly exposed on the internet... which is not the case for most people

• causal 6mo ago
  Until recently, this was default configuration Edit: Default binding was to 0.0.0.0, and if you were not aware of this and assumed your router was keeping you safe, you probably should not be using OpenClaw. In fact some services may still default to 0.0.0.0: https://github.com/openclaw/openclaw/issues/5263 https://github.com/openclaw/openclaw/issues/5263 https://github.com/openclaw/openclaw/commit/5643a934799dc523ec2ef18c007e1aa2c386b670 https://github.com/openclaw/openclaw/commit/5643a934799dc523...
  • charcircuit 6mo ago
    Since pretty much the beginning it wasn't and the documentation explicitly warned not to make it public, exposing it to the internet. It included information on how you can properly forward the gateway port to your machine without opening it up to the internet.
  • earnesti 6mo ago
    I have used openclaw pretty long but at no point it has proposed doing anything like that.
  • nickthegreek 6mo ago
    Not true. So many people love to come out of the woodwork on these openclaw posts who have no first hand knowledge of the software. It is stunning.
• quietsegfault 6mo ago
  It’s possible, and maybe even trivial, to hit a malicious website that tries to connect to the OpenClaw port on your local machine. A malicious web page runs JavaScript that makes a fetch() or XMLHttpRequest to http://localhost:CLAWPORT — your browser executes that from your machine, so it bypasses your router/firewall entirely. If OpenClaw is listening on localhost with no auth, the browser just connects to it. Same-origin policy doesn’t save you because the request originates from your own machine.