2026-07-01-openclaw-security-hardening-commit-on-main-not-yet-tagged-bound-o

Security-hardening commit on main (not yet tagged): bound OAuth token endpoint response reads in the Anthropic OAuth path (channel: main-unreleased, 2026-07-01). Operator consequence: Watch item, not yet actionable via a release. It bounds how much the client reads from the OAuth token endpoint (DoS/abuse hardening on the Anthropic auth flow). Track for the next tag; no operator action until it ships in a stable release. Full receipted detail lives in harvest/watchlist.md.

Receipt

• https://github.com/openclaw/openclaw/pull/96644