Security Configuration

export SECURITY_MODE=standard

# .profclaw/settings.yml
security:
  guards:
    - pattern: "rm -rf /"
      action: deny
      reason: "Dangerous recursive delete"
    - pattern: "DROP TABLE"
      action: deny
      reason: "SQL table drop blocked"
    - pattern: "curl.*|.*sh"
      action: prompt
      reason: "Pipe to shell detected"
    - path: "/etc/*"
      action: deny
      reason: "System file access blocked"
    - path: "~/.ssh/*"
      action: deny
      reason: "SSH key access blocked"

security:
  allowedPaths:
    - "./src"
    - "./tests"
    - "./docs"
  deniedPaths:
    - "./.env"
    - "./.env.local"
    - "./secrets"
    - "~/.ssh"

security:
  auditLog:
    enabled: true
    retentionDays: 90
    includeToolResults: false  # Set true for full audit trail
    exportFormat: json         # json | csv

profclaw audit list
profclaw audit list --since 24h
profclaw audit export --format json --output audit.json

security:
  devicePairing:
    enabled: true
    maxDevices: 10
    expirySeconds: 300
    requireApproval: true  # Manual approval for new devices

profclaw device pair

security:
  network:
    allowedDomains:
      - "api.anthropic.com"
      - "api.openai.com"
      - "github.com"
      - "*.githubusercontent.com"
    blockedDomains:
      - "*.malware.com"
    maxRequestsPerMinute: 60

security:
  plugins:
    sandbox: true
    allowedPermissions:
      - "read_file"
      - "write_file"
    deniedPermissions:
      - "shell_exec"
      - "network_unrestricted"
    reviewRequired: true  # Require manual review before enabling