Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in miniClaw, please report it privately via email:

Please do not open a public GitHub issue for security vulnerabilities. For non-security questions, use the support path in SUPPORT.md.

We aim to:

acknowledge reports within 48 hours
provide an initial assessment within 7 days
coordinate a fix and disclosure timeline with the reporter when the issue is valid

miniClaw requires an Anthropic API key to run. Please follow these practices:

Never commit your .env file or API keys to version control
The .gitignore already excludes .env — do not remove this rule
If you accidentally expose a key, revoke it immediately at console.anthropic.com
Use environment variables or .env files for all secrets
Never paste live tokens into issues, pull requests, or screenshots