This repository maintains the openclaw-generic-http OpenClaw channel plugin.
Please report issues here when they affect:
- plugin request signing or signature verification
- webhook or stream request validation
- outbound delivery behavior
- route mapping behavior
- host adapter or plugin lifecycle wiring
- plugin configuration parsing or normalization
If you believe you found a security vulnerability, report it privately first.
Please do not open a public issue, discussion, or pull request for an unpatched vulnerability, exploit path, secret, or proof of concept.
Preferred disclosure path:
- Open a private GitHub Security Advisory for this repository, if enabled.
- If private advisories are not available, contact the repository owner or organization through the contact information published on GitHub.
Include:
- affected component
- impact
- reproduction steps
- environment and version information
- remediation suggestion, if you have one
Reports with a clear reproduction path and demonstrated impact are triaged faster.
The following are usually not treated as plugin security issues by themselves unless they show a concrete boundary bypass or real impact:
- missing hardening advice without an exploitable path
- issues that require changing the published protocol signing rules
- platform-side issues that live only in
openclaw-http-bridge - expected behavior from a trusted-installed plugin running with host access
This plugin is designed to work with the external
openclaw-http-bridge platform repository. If an issue lives only in the
platform implementation or its docs, report it there instead of here.