OpenSpace/openspace
efe-arv 0711cfd7fa security: harden telemetry, cloud defaults, and credential scoping
Changes:
- Disable telemetry by default (opt-in instead of opt-out)
- Strip user query text and LLM response text from telemetry events
- Remove server_identifiers and tools_available_names from telemetry
- Default search_scope to 'local' (no auto-import of unverified cloud skills)
- Default auto_import to False in search_skills
- Scope OpenClaw credential reading to openspace env block only
- Enable sandbox by default in security config
- Add SECURITY.md with guidance for users

See PR description for full security audit findings.
2026-04-05 21:13:42 +03:00
..
agents clean up LLM credential resolution 2026-04-05 15:13:07 +08:00
cloud feat: migrate cloud search to server-side embedding endpoint 2026-04-02 23:17:44 +08:00
config security: harden telemetry, cloud defaults, and credential scoping 2026-04-05 21:13:42 +03:00
grounding fix: replace ErrorCode enum calls with GroundingError raises 2026-04-03 23:10:28 +08:00
host_detection security: harden telemetry, cloud defaults, and credential scoping 2026-04-05 21:13:42 +03:00
host_skills docs: update openclaw setup instructions in host_skills README 2026-03-28 10:53:53 +08:00
llm clean up LLM credential resolution 2026-04-05 15:13:07 +08:00
local_server initial commit 2026-03-24 16:03:22 +08:00
platforms fix: rename platform package to platforms 2026-03-26 00:09:50 +08:00
prompts initial commit 2026-03-24 16:03:22 +08:00
recording fix: rename platform package to platforms 2026-03-26 00:09:50 +08:00
skill_engine docs: update register_skill_dir docstring to reflect idempotent return 2026-03-31 14:58:01 +08:00
skills initial commit 2026-03-24 16:03:22 +08:00
utils security: harden telemetry, cloud defaults, and credential scoping 2026-04-05 21:13:42 +03:00
.env.example clean up LLM credential resolution 2026-04-05 15:13:07 +08:00
__init__.py initial commit 2026-03-24 16:03:22 +08:00
__main__.py fix: CLI entry point now respects OPENSPACE_MODEL and OPENSPACE_LLM_* env vars 2026-03-31 15:36:13 +08:00
dashboard_server.py fix: use hash-based workflow ID to prevent separator collisions 2026-03-31 17:38:39 +08:00
mcp_server.py security: harden telemetry, cloud defaults, and credential scoping 2026-04-05 21:13:42 +03:00
tool_layer.py fix: pass max_iterations to grounding agent in no-skill execution path 2026-03-31 17:03:00 +08:00