Keep API Keys Out of the Model: OpenClaw 2.0 Checklist

If you run a self-hosted AI assistant and are about to move to OpenClaw 2.0, treat the upgrade as a security checkpoint. OpenClaw announced version 2.0 on August 31, 2026, as the largest update in the project's history. The hours you spend before the restart are cheaper than the hours you spend after a leaked key.

A big release changes defaults, permissions, and the places where secrets can appear. You can still keep the margin: fewer moving parts, fewer exposed ports, fewer credentials in the model's context.

The scale of the change is the reason to slow down

OpenClaw 2.0 was built by 933 contributors, including 569 first-time contributors, and contained more than 16,000 pull requests. It also contained roughly half of all pull requests ever merged into the project. That kind of change can improve the assistant, but it can also move the boundary between your machine and the outside world.

The version bump will not make these choices for you

Before you run the upgrade, make a copy of the things you would hate to lose. Config files, state, tool settings, and any local notes the assistant can read are all part of the blast radius. A backup is not a security control by itself, but it gives you a way back when a setting does not behave the way you expected.

The checklist below is the part of the upgrade that belongs to you. Each item is small enough to check in a minute. The first three items are about recoverability and visibility: a copy, a known entry point, and a diagnostic readout before the assistant starts doing work. The rest are about keeping credentials out of reach.

• Copy the config file and the local data folder to a separate folder before you restart.
• Check that the gateway is reachable only from the interface you intend.
• Run the diagnostic command and read the output before giving the assistant any new task.
• Enable protected credentials for any credential you pass to an agent in a shared environment.
• Turn on the sandbox for untrusted code.
• Do not use shared sessions as a security boundary.
• Check that only your user can read the state directory.
• List the open ports, and confirm each one has a reason to be reachable.
• Confirm an egress rule limits outbound destinations.
• Disable unused tools, and require approval for actions that delete, send, or spend.

Shared sessions are easy to misunderstand. Shared cloud session controls in 2.0 did not provide tenant isolation, or isolation between separate users, and were not a security boundary. If two people, two agents, or two workspaces share a session, treat the session as a common room, not a private one.

Protected credentials matter because a shared environment can show more than you intend. OpenClaw 2.0 added a protected-credentials feature that lets users give credentials to agents in shared environments without showing them in chat. If a credential appears in chat, it becomes part of the context the model can repeat, summarize, or leak into a log. Protected credentials are useful, but they are not a substitute for keeping the credential out of the model's reach in the first place.

Untrusted code should not get the same rights as your own scripts. The sandbox for untrusted code in 2.0 was not enabled by default. If the sandbox is off, a bad instruction can touch files, call tools, or move data.

The local data directory is part of the security model

Stored values in the Secret Store were not encrypted at rest in 2.0, and the store relied on the filesystem permissions of the state directory. If another user, service, or process can read it, the stored values are exposed even if the chat window looks clean.

Then check that backups, logs, and sync folders do not copy the state directory to a place with looser permissions. A secret that is hidden from the model but visible to the filesystem is still a secret that can leak.

Finish by looking at the network. The assistant should be able to reach only the services it needs. A firewall rule or allowlist can stop a bad instruction from reaching an unknown host. The rule should be narrow enough that you can list the allowed hosts and explain why each one is there.