Hyperclaw is local-first software that can coordinate AI runtimes, read local files, and relay messages through a connector daemon. Please treat security reports seriously and do not publish exploit details before maintainers have a chance to respond.

The open-source project is pre-1.0. Security fixes target the latest main branch unless a release branch is explicitly marked as supported.

Please do not open a public GitHub issue for suspected vulnerabilities.

Use GitHub's private vulnerability reporting for this repository if it is enabled:

https://github.com/duolahypercho/HyperClaw/security/advisories/new

If private reporting is not available yet, contact the maintainers privately through the repository owner account and avoid posting exploit details in a public issue.

Include:

• A short summary of the issue.
• Affected paths, APIs, or commands.
• Reproduction steps or a minimal proof of concept.
• Expected impact.
• Whether the issue requires local machine access, a malicious workspace, a malicious connector, or remote network access.

We aim to acknowledge valid reports within 7 days and will coordinate disclosure timing with the reporter when possible.

Community Edition defaults to local-only mode:

• The dashboard talks to a connector on localhost.
• Hub URLs are empty unless explicitly configured.
• Electron builds use mode: "local" unless BUILD_FLAVOR=cloud or remote packaging config is set.
• Login is not required in the default OSS flow (NEXT_PUBLIC_HYPERCHO_AUTH_ENABLED=false).
• The security boundary for CE is physical access to the machine — anyone who can reach localhost:1000 and :18790 can invoke bridge actions.
• Do not expose the CE dashboard on the public internet without enabling Hypercho auth or another access gate.

Cloud / multi-device mode adds:

• Hypercho UserManager for accounts and JWT issuance.
• A proprietary Hub for device registry and command relay.
• NEXTAUTH_SECRET in HyperClaw must match JWT_TOKEN in UserManager (and Hub verification) or login succeeds but device APIs return 401.
• Set HYPERCLAW_ALLOW_NETWORK_LOGIN=true only on trusted private networks; it allows credential login from non-localhost hosts.

The proprietary Hyperclaw Cloud hub, billing, and hosted runtime infrastructure are not part of this repository.

Please pay extra attention to:

• Connector bridge actions that execute commands or write files.
• Runtime adapters for Claude Code, Codex, OpenClaw, and Hermes.
• Electron preload.js and IPC handlers.
• Auth/session handling in pages/api/.
• User-uploaded files and knowledge ingestion paths.
• Any code that parses model output into tool calls.

Never commit:

• .env* files containing real values.
• Device tokens, JWTs, OAuth tokens, or API keys.
• Cursor/agent debug logs.
• Model provider credentials.
• Private keys or certificates.

The repository .gitignore blocks common secret and agent-scratch paths, but it is only a safety net. Review your diff before opening a pull request.