Security Guard Report - 2026-03-15
Patrol time: 03:30 AM (America/New_York)
Agent: Security Guard (Claude Opus)
AutoAudit verified: Yes (2026-03-15)
Previous report: 2026-03-14
Executive Summary
Overall threat level: MEDIUM (unchanged from 2026-03-14)
No new critical findings. All prior recurring findings persist. This is the
7th consecutive patrol for the lifeboat-system credential directory issue. The Expo dev server that was flagged as NEW last patrol (Mar 14) is still running — PID changed from 18870 to 64322, indicating a restart during the session (Ghost actively developing CLAP app). LuLu firewall active. FileVault daemon running. Nightly backup completed successfully at 02:02 on Mar 15.
Changes since last patrol:
- Expo dev server: still running (new PID 64322, started 10:38 PM Mar 14). Still LAN-bound.
- Brainmap Flask server: no longer running (was noted in prior log but process not found now).
- vitals-api (PID 62431) and vital-server (PID 75085): still in SIGTERM state per launchctl, processes still exist.
- api.clawstin.org and voice.clawstin.org tunnel routes: no backend service listening (502 expected). Benign.
- 7 jest worker processes running under clawstin-app (Expo bundler workers).
This patrol identified
9 findings: 1 severity 7, 4 severity 5, 1 severity 3, and 3 severity 1-2.
FINDINGS
SG-2026-03-15-001: Lifeboat-System Credential Directory in Workspace
Severity: 7 (unchanged — 7th consecutive patrol)
Evidence:
```
$ stat ~/.openclaw/workspace/lifeboat-system/
drwxr-xr-x 9 aicomputer staff 288 "Mar 6 17:21:55 2026" (755 — world-readable dir listing)
$ ls -la lifeboat-system/cloudflared/
-rw------- 1 aicomputer staff 175 Mar 15 02:57 2c29ad40-*.json
-rw------- 1 aicomputer staff 266 Mar 15 02:57 cert.pem
-rw------- 1 aicomputer staff 442 Mar 15 02:57 config.yml
$ ls -la lifeboat-system/den/
-rw------- 1 aicomputer staff 4792 Mar 15 02:57 creds.enc
-rw------- 1 aicomputer staff 61 Mar 15 02:57 fernet-key.b64
$ ls -la lifeboat-system/gmail-tokens/
-rw------- 1 aicomputer staff 984 Mar 15 02:57 auth.py
-rw------- 1 aicomputer staff 404 Mar 15 02:57 credentials.json
-rw------- 1 aicomputer staff 695 Mar 15 02:57 token-adalsey.json
-rw------- 1 aicomputer staff 695 Mar 15 02:57 token-clawstinai.json
-rw------- 1 aicomputer staff 695 Mar 15 02:57 token-krspamgang.json
$ ls -la lifeboat-system/rclone/
-rw------- 1 aicomputer staff 546 Mar 15 02:57 rclone.conf
$ ls -la lifeboat-system/signal-data/
-rw------- 1 aicomputer staff 1637 Mar 15 02:57 535318
drwxr-xr-x 6 aicomputer staff 192 Mar 6 17:21 535318.d
-rw------- 1 aicomputer staff 179 Mar 15 02:57 accounts.json
$ grep "lifeboat-system" .gitignore
lifeboat-system/ (confirmed gitignored)
```
Contents at risk: Fernet key (`den/fernet-key.b64`) + encrypted credential blob (`den/creds.enc`), Google OAuth client secret and refresh tokens for 3 Gmail accounts, Cloudflare tunnel cert + credentials, rclone config for Google Drive, Signal protocol session state.
Impact: If fernet key + encrypted blob are exfiltrated together, ALL stored credentials can be decrypted offline. Gmail OAuth tokens allow full access to 3 accounts.
Mitigations: Gitignored (confirmed), all files 600 perms, subdirectories 700. But parent dir `lifeboat-system/` is 755 — any local process can list its contents.
Rationale: Per rubric: credential files accessible locally without privilege = severity 7-8. The 755 parent directory is the specific concern. Files themselves are 600 (good). Nightly lifeboat backup refreshes these files (~02:57 AM per timestamps today), so they're always current.
Recommendation: `chmod 700 lifeboat-system/` to remove world-readable directory listing.
Accepted risk: No — not yet in accepted-risks.md.
SG-2026-03-15-002: Cloudflare Tunnel Serves 4 Ingress Routes
Severity: 3 (accepted risk for static site; informational for others)
Evidence:
```
$ cat lifeboat-system/cloudflared/config.yml
tunnel: 2c29ad40-[REDACTED]
credentials-file: /Users/aicomputer/.cloudflared/2c29ad40-*.json
ingress:
- hostname: clawstin.org -> localhost:8877 (Python http.server, PID 75085)
- hostname: voice.clawstin.org -> localhost:3334 (NO PROCESS — will 502)
- hostname: webhook.clawstin.org -> localhost:18789 (openclaw-gateway, PID 59999)
- hostname: api.clawstin.org -> localhost:8765 (NO PROCESS — will 502)
- service: http_status:404
$ ps aux | grep http.server (filtered)
PID 75085 — python3 -m http.server 8877 --directory ~/clawstin-site
$ ps aux | grep openclaw (filtered)
PID 59999 — openclaw-gateway
```
Impact: clawstin.org serves static site (telemetry only — accepted). webhook.clawstin.org serves the OpenClaw gateway (authenticated via Signal pairing). voice.clawstin.org and api.clawstin.org have no backend — safe (502 response).
Rationale: Static site exposure accepted per SG-2026-03-10-002. Gateway has its own auth. Unused routes benign.
Accepted risk: Yes — SG-2026-03-10-002 covers clawstin.org static site.
SG-2026-03-15-003: Chrome Remote Desktop Running
Severity: 3 (accepted risk)
Evidence:
```
$ ps aux | grep remoting (filtered)
PID 1505 — remoting_me2me_host --host-config=...org.chromium.chromoting.json
--ssh-auth-sockname=/tmp/chromoting.aicomputer.ssh_auth_sock
PID 1478 — remoting_me2me_host_service --run-from-launchd
PID 805 (root) — remoting_agent_process_broker
```
Impact: Full desktop access via Google account + PIN. SSH auth socket at /tmp path.
Rationale: Accepted per SG-2026-03-09-005. Intentional remote access tool.
Accepted risk: Yes — SG-2026-03-09-005.
SG-2026-03-15-004: Signal-CLI HTTP Daemon on 127.0.0.1:8080 (No Auth)
Severity: 5 (unchanged — 7th consecutive patrol)
Evidence:
```
$ ps aux | grep signal-cli (filtered)
PID 60024 — java ... org.asamk.signal.Main -a +16072208785 daemon --http 127.0.0.1:8080 --no-receive-stdout
```
Impact: Any local process can send Signal messages as +16072208785 via HTTP requests to 127.0.0.1:8080. No authentication on the HTTP API. Bound to localhost only — not externally accessible.
Rationale: Per rubric, locally-accessible unauthenticated service = severity 5-6. Mitigated by localhost binding. A compromised local process could abuse this for phishing/impersonation via Signal.
Accepted risk: No.
SG-2026-03-15-005: Proton Mail Bridge Sentry Key in Process List
Severity: 2 (unchanged)
Evidence:
```
$ ps aux | grep sentry_key (filtered)
PID 1508 — crashpad_handler ... --url=
https://mail-api.proton.me:443/.../minidump/?sentry_key=[REDACTED]
```
Impact: This is a Proton-issued DSN key for crash reporting, not a Clawstin credential. Visible to any process that can list processes (`ps aux`). Standard application behavior.
Rationale: Per rubric, informational. Not a Clawstin-managed secret.
Accepted risk: N/A — informational only.
SG-2026-03-15-006: Brave Browser Remote Debugging Port 18800
Severity: 5 (unchanged — 7th consecutive patrol)
Evidence:
```
$ ps aux | grep brave.*remote-debugging (filtered)
PID 61069 — Brave Browser --remote-debugging-port=18800
--user-data-dir=~/.openclaw/browser/openclaw/user-data
Multiple renderer processes (PIDs 61092, 61095, 61097, 61098) also reference port 18800.
```
Impact: Chrome DevTools Protocol accessible on localhost:18800. Allows full browser manipulation including reading cookies, intercepting traffic, and executing JavaScript in any open tab. Bound to localhost only.
Rationale: Per rubric, localhost service with sensitive data access = severity 5. Intentional for OpenClaw browser automation. Mitigated by localhost binding and LuLu firewall.
Accepted risk: No — not yet in accepted-risks.md.
SG-2026-03-15-007: Ollama LLM Server Running
Severity: 1 (unchanged)
Evidence:
```
$ ps aux | grep ollama (filtered)
PID 1511 — /Applications/Ollama.app/Contents/Resources/ollama serve
PID 1494 — /Applications/Ollama.app/Contents/MacOS/Ollama hidden
```
Impact: Local LLM inference server on default port (11434). Localhost only. No sensitive data exposure.
Rationale: Per rubric, informational. Standard development tool.
Accepted risk: N/A.
SG-2026-03-15-008: Stale FER Monitor Plist in LaunchAgents
Severity: 1 (unchanged — per AutoAudit, 7th consecutive)
Evidence:
```
$ ls ~/Library/LaunchAgents/ | grep fer-monitor
clawstin.fer-monitor.plist (file exists)
$ launchctl list | grep fer-monitor
(no output) — NOT loaded
$ ls lifeboat-system/launch-agents/ | grep fer-monitor
clawstin.fer-monitor.plist (also in lifeboat copy)
```
Impact: Stale plist pointing to deleted `scripts/fer-monitor.py`. Not loaded by launchd (confirmed). If loaded, would fail silently. No security impact.
Rationale: Per rubric, informational. Housekeeping item only.
Accepted risk: N/A.
SG-2026-03-15-009: Expo Dev Server Running on LAN
Severity: 5 (2nd consecutive patrol — was NEW last patrol)
Evidence:
```
$ ps aux | grep expo (filtered)
PID 64322 — node ~/clawstin-app/node_modules/.bin/expo start --lan --clear
(started 10:38 PM Mar 14)
PID 64310 — npm exec expo start --lan --clear
7 jest worker processes (PIDs 64383-64389) — Expo bundler workers
```
Impact: Expo Metro bundler bound to LAN interface (not just localhost). Typical ports: 8081 (Metro), 19000 (Expo DevTools). Accessible to any device on the local network (192.168.1.x). A device on the same WiFi network could potentially interact with the dev server.
Rationale: Per rubric, service bound to non-localhost interface = severity 5-6. The `--lan` flag is intentional for mobile development (Ghost developing CLAP app and pushing to phone). Risk is limited to LAN exposure only.
Recommendation: When not actively developing, stop the Expo server or use `--localhost` instead of `--lan`.
Accepted risk: No.
Threat Landscape (External Intelligence)
Status: NOT CHECKED (7th consecutive patrol)
The security guard sandbox does not have network access. External threat intelligence from NVD, Node.js advisories, macOS security bulletins, and GitHub advisory feeds could not be checked.
Relevant context from system state:
- OpenSSL version: 3.6.1 (2026-01-27) — current
- Node.js: v25.6.1 (via homebrew) — recent
- signal-cli: 0.13.24 — recent
- macOS: appears to be current Sonoma (system uptime since Mar 7)
Note: Ghost should periodically check
https://nodejs.org/en/security and
https://nvd.nist.gov for any CVEs affecting Node.js 25.x or macOS Sonoma.
Risk Acceptance Notes
| Finding | Matches Accepted Risk? | Action |
|---------|----------------------|--------|
| SG-2026-03-15-001 (Lifeboat creds) |
No — not accepted | 7th consecutive. Recommend accepting or fixing (chmod 700). |
| SG-2026-03-15-002 (Cloudflare tunnel) |
Yes — SG-2026-03-10-002 | Rated 3 per dedup rule. |
| SG-2026-03-15-003 (Chrome Remote Desktop) |
Yes — SG-2026-03-09-005 | Rated 3 per dedup rule. |
| SG-2026-03-15-004 (Signal-CLI HTTP) |
No — not accepted | 7th consecutive. |
| SG-2026-03-15-005 (Proton sentry key) | N/A | Informational only. |
| SG-2026-03-15-006 (Brave debug port) |
No — not accepted | 7th consecutive. |
| SG-2026-03-15-007 (Ollama) | N/A | Informational only. |
| SG-2026-03-15-008 (Stale FER plist) | N/A | Housekeeping. |
| SG-2026-03-15-009 (Expo LAN) |
No — not accepted | 2nd consecutive. |
LaunchAgent Status
| Agent | PID | Status | Notes |
|-------|-----|--------|-------|
| clawstin.cloudflared | 27405 | Running (exit 0) | Healthy |
| clawstin.vital-server | 75085 | Exit -15 (SIGTERM) | Process alive despite SIGTERM |
| clawstin.vitals-api | 62431 | Exit -15 (SIGTERM) | Process alive despite SIGTERM |
| clawstin.fer-monitor | — | Not loaded | Stale plist (7th audit) |
| clawstin.balance-checker | — | Disabled (.disabled) | Accepted (SG-2026-03-10-006) |
Infrastructure Summary
-
LuLu Firewall: Running (PID 1491 app + PID 699 system extension)
-
FileVault: filevaultd running (PID 1007)
-
Nightly Backup: Completed 2026-03-15 02:02:07 (git commit + lifeboat to Google Drive)
-
Billing Watchdog: Last OK at 03:28:17 (5-minute intervals, all OK)
-
Tailscaled: Running (PID 655, root)
-
Docker Desktop: Running (PID 1574 + helpers)
-
Signal-CLI: Running (PID 60024)
-
OpenClaw Gateway: Running (PID 59999)
-
Proton Mail Bridge: Running (PID 1501/1510)
Credential Scan Results
- `.env` files in workspace:
None found
- API key patterns (sk-ant-, ghp_, xox*, AIza, AKIA) in config/data/log files:
None detected (sandbox restrictions limited deep recursive grep — see Sandbox Limitations)
- JWT tokens in log files:
Not detected
- Stray credential files in /tmp:
Could not check (sandbox blocked)
- CREDENTIALS.md: Contains only references to Den (no raw secrets)
Sandbox Limitations This Patrol
The following checks were blocked by the security-guard sandbox restrictions:
1. `lsof -i -P -n | grep LISTEN` — blocked (could not enumerate open ports directly)
2. `find -exec grep` — blocked (could not do deep recursive credential scans)
3. `grep -rl` with certain patterns — blocked on some path combinations
4. `/var/log/secure` and `/var/log/auth.log` — do not exist on macOS
5. Network access for external threat intelligence — blocked (7th consecutive)
6. `npm audit` — no package-lock.json in workspace root; clawstin-app is outside workspace
7. LuLu rules: NSKeyedArchiver format readable but action values (182/200) not decoded to allow/block
8. `git remote -v` and `git log` — blocked by sandbox
Workaround used: Process analysis via `ps aux`, `launchctl list`, file listing, targeted `grep` on known-risk files.
End of Security Guard Report — 2026-03-15
Next patrol: 03:30 AM 2026-03-16