OpenClaw merged a small but important security hygiene fix this morning: PR #127071 redacts registered secrets from non-interactive onboarding gateway health failures.
The bug affected a failure path, not the normal happy path. When non-interactive onboarding ran gateway health checks, probe errors, daemon diagnostics, or recovery details could include registered secret values. Those values could then be rendered in JSON output, text output, or propagated failure messages.
The Boundary That Changed
The fix moves redaction to the onboarding failure output owner. Before diagnostic output is rendered, OpenClaw now redacts the complete payload. The PR notes that classification still uses the original diagnostic values, so recovery guidance can remain specific without exposing the sensitive strings that were discovered during setup.
That division is the right one:
- Keep raw diagnostic information available inside the classification boundary.
- Redact the full payload before anything becomes user-facing output.
- Preserve actionable recovery advice.
- Avoid leaking registered secrets through JSON, text, or forwarded failure messages.
For operators, this is especially relevant in scripts and CI-like setup flows where non-interactive output often ends up in logs, transcripts, bug reports, or support channels.
Why It Matters
Onboarding commands live close to credentials. They touch provider keys, gateway URLs, daemon health, local state paths, and recovery diagnostics. A failure message that contains too much detail can accidentally become a secret exfiltration surface.
The PR's user impact section is concise: non-interactive onboarding health failures keep useful diagnostics while registered secrets are omitted from every rendered failure surface.
This is not a broad redesign of OpenClaw's secret system. It is a targeted fix in the path where setup diagnostics cross from internal recovery logic into operator-visible output. That is exactly where redaction needs to be boring and consistent.
Validation
The maintainer proof covers both behavior and leakage risk. The focused onboarding gateway test suite passed 21 tests on Node 24.15.0. A direct fake-sentinel output probe reported no leaked sentinel, and a TruffleHog scan over the exact branch patch found zero verified or unknown secrets.
The changed-file check passed formatting, guards, dead-code scanning, and core production typechecking. The PR also reports a clean branch autoreview with no accepted or actionable findings.
Bottom Line
PR #127071 closes a classic automation edge case: the tool failed safely in product behavior, but its failure report could reveal more than it should.
OpenClaw's onboarding diagnostics should now remain useful without turning failed gateway health checks into accidental secret disclosures.