security.
Everything we've published on security across guides, agents, hardware reviews and glossary entries — 12 entries in total.
Guides (10)
- API Keys Out of ps OutputDirty COW · 2026-02-18
Move API keys from command-line arguments to a chmod 600 env file, hiding them from ps output.
- API Key Management (Dashboard KEYS Page)Gateway · 2026-02-18
Web-based API key management with masked display, inline editing, one-tap provider testing, and live process.env updates.
- OpenClaw security crisis 2026: what you need to knowAI Agents · 2026-04-28
OpenClaw shipped a one-click RCE in January 2026. ~1000 public installations were running without auth. Here's what happened, what's exposed, and what to do.
- The complete OpenClaw timeline (Nov 2025 → Apr 2026): from weekend project to 135K installs to security crisisAI Agents · 2026-04-28
Long-form history of OpenClaw — Peter Steinberger's autonomous AI agent. Origin, viral growth, technical architecture, the move to OpenAI, the security collapse, and what it means for self-hosted AI in 2026.
- Self-hosted AI security best practices 2026 — the operator's playbookAI Agents · 2026-05-01
Practical security playbook for self-hosted AI agent operators in 2026. Threat model, sandbox setup, credential storage, network isolation, monitoring, incident response. Step-by-step, post-OpenClaw-crisis.
- GDPR for self-hosted AI agents in 2026 — a practical compliance walkthroughAI Agents · 2026-05-03
Practical GDPR compliance walkthrough for self-hosted AI agent operators. Lawful basis, data residency, sub-processor disclosure, DPIA triggers, breach notification. Plain language. Not legal advice.
- vLLM security CVEs 2026: auth bypass and trust_remote_code RCEAI Agents · 2026-07-06
vLLM shipped CVE-2026-48746 (auth bypass, CVSS 9.1) plus trust_remote_code RCEs CVE-2026-4944 and CVE-2026-5817. Upgrade to 0.22.1+ now and lock these settings.
- Vector database authorization CVEs: ChromaDB, Weaviate 2026AI Agents · 2026-07-06
ChromaDB (CVE-2026-45830 to -45833) and Weaviate (CVE-2026-59093) shipped multi-tenant authorization-bypass CVEs in 2026. The shared pattern, and the fix.
- MLflow authorization CVEs 2026: artifacts, traces, gateway leaksAI Agents · 2026-07-06
MLflow shipped three authorization and secrets CVEs in 2026 — CVE-2026-2651 (critical), CVE-2026-8147, and CVE-2026-4035. What each one breaks and how to patch.
- Ollama heap leak (CVE-2026-5757) and inference-server memory safetyAI Agents · 2026-07-06
Ollama CVE-2026-5757 leaks heap memory to unauthenticated callers; Triton's DALI backend (CVE-2026-24213/24214/24264) has integer-overflow and OOB bugs.
Agents (1)
- OpenClaw
The original viral self-hosted AI agent. Post-crisis 2026.4 line is genuinely safer; pre-2026.3 is genuinely dangerous.
Glossary (1)
- Zero trust — Security architecture that assumes no implicit trust and verifies every access request.