Evidence record / openclaw
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openclaw-browser-pairing-uses-a-private-file-instead-of-credential-bearing-process-arguments
Browser pairing uses a private file instead of credential-bearing process arguments. A separate local OS user on a default-procfs host could read the one-time pairing URL from the opener command line and redeem owner bootstrap first. Dashboard/onboarding now write a redirect document using POSIX private modes or Windows owner-only creation, pass only its non-secret path to the opener, and schedule cleanup. This avoids putting the secret in opener argv; it does not hide credentials deliberately printed or copied by the owner.
Channel: tagged-release. Half: defect. Date: 2026-10-18.
Operator consequence: Upgrade before browser bootstrap on shared hosts. Keep OS-user separation and avoid copying credential-bearing URLs into shared logs; the private browser handoff covers its own launch path, not every way to disclose a credential.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openclaw-browser-pairing-uses-a-private-file-instead-of-credential-bearing-process-arguments
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openclaw-browser-pairing-uses-a-private-file-instead-of-credential-bearing-process-argumentsgithub.com/openclaw/openclaw/commit/fb08d790a901870455c35bc437dae2c9cc9bc523tagged commit file2026-10-24-openclaw-browser-pairing-uses-a-private-file-instead-of-credential-bearing-process-argumentsopenclaw/openclaw / src/infra/browser-handoff.tstagged commit file2026-10-24-openclaw-browser-pairing-uses-a-private-file-instead-of-credential-bearing-process-argumentsopenclaw/openclaw / src/infra/browser-open.ts
Versioned source: run artifact