Please do not open a public GitHub issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting feature on this repository, or contact the maintainers privately.

We'll acknowledge receipt within 7 days and aim to have a fix or mitigation within 30 days for high-severity issues.

Only the latest minor release receives security updates while the project is pre-1.0.

OpenClaw-BCI runs locally by default. Before exposing any of its components to a network, review the following:

• Default bind address is 127.0.0.1. Do not change BCI_HOST to 0.0.0.0 without adding authentication and TLS in front of it.
• There is no built-in authentication. If you expose the server beyond localhost, put it behind a reverse proxy that handles auth.
• CORS is restricted by default to same-origin requests. Override via BCI_CORS_ORIGINS only with explicit allowlisted origins.
• Webhook delivery uses the BCI_WEBHOOK_TIMEOUT_S setting but does not verify TLS certificates of webhook targets. Run only with trusted webhook destinations.
• Session recordings contain brain state data. Treat them as sensitive health-adjacent information.

• The plugin reads from BCI_STATE_SERVER_URL without certificate pinning. Use HTTPS only with trusted state servers.
• The plugin injects brain state into LLM context. If the LLM provider logs prompts, your brain state metadata is logged with them. Review your LLM provider's data retention policy.

Brain data from consumer BCI devices is not clearly protected by HIPAA in the United States. Some states (California, Colorado, Connecticut) have added neural data to their consumer health data definitions. Treat any recorded session as sensitive personal health information:

• Encrypt session recordings at rest
• Do not transmit unencrypted
• Obtain explicit user consent before recording
• Provide users with a way to delete their recordings

This project uses Dependabot to track security updates in Python (pyproject.toml) and Node.js (package.json) dependencies. PRs from Dependabot are reviewed and merged on a rolling basis.