OpenClaw merged a security-focused redaction fix in PR #112947, closing a gap where AWS credential material could be only partially masked in diagnostic and transcript-style text.
The pull request says the old behavior could mask an AWS access key ID while leaving the paired secret access key visible when credentials appeared in common file, JSON, or bare-token formats. That is exactly the kind of small logging edge case that can become a serious incident when support bundles, copied transcripts, or approval previews move between systems.
What Changed
The built-in logging redactor now recognizes AWS secret access key field names and high-entropy 40-character credential values during the same default redaction pass that already handles access key IDs.
Support-bundle text redaction also maps those values to a support-specific placeholder. The implementation note is important: the PR states that provider auth, config, storage, and runtime behavior are unchanged.
That means this is not a credential migration or a change to how OpenClaw stores provider settings. It is a defensive output filter for places where sensitive text can be echoed back to humans or tools.
Why This Matters
OpenClaw operators increasingly use agents across CI, cloud workers, coding sessions, support workflows, and approval surfaces. Those environments naturally produce logs and transcripts. Even when the product correctly stores secrets, a tool result, copied file, failed command, or support export can accidentally include sensitive material.
AWS credentials are especially risky because an access key ID and secret access key are often shown near each other. Redacting only the identifier can create a false sense of safety while the usable secret remains in view.
This patch expands the default protection around:
- log output
- diagnostic text
- support exports
- transcript-style surfaces
- approval previews
For teams that share diagnostics with support, paste session output into issues, or retain transcripts for audits, the change reduces the chance that a credential leak survives in plain text.
No Operator Migration
The user impact section is deliberately low-drama: users and operators get safer redaction when AWS credential material is echoed or captured, and no configuration or migration is required.
That makes this the right kind of security maintenance patch. It tightens a sensitive output path without asking administrators to rotate settings, change provider profiles, or rework existing OpenClaw deployments.
Validation
The PR reports focused tests for the logging redactor and diagnostic support export paths:
node scripts/run-vitest.mjs src/logging/redact.test.ts src/logging/diagnostic-support-export.test.tsgit diff --check
The patch is also marked AI-assisted, with maintainer review of the relevant behavior. For operators, the practical takeaway is simple: OpenClaw's default redaction layer now covers the AWS secret half of an AWS key pair in the same places it already protected access key IDs.