Report security issues privately to the maintainers instead of opening a public issue.

Preferred channel:

• GitHub private vulnerability reporting: https://github.com/amittell/openclaw-scheduler/security/advisories/new

Include:

• affected version
• deployment mode
• reproduction steps
• impact
• suggested mitigation if known

Security-sensitive areas include:

• shell job execution
• dispatcher lease and run fencing
• process-group timeout and cancellation
• gateway credential handling
• transactional delivery outbox and attachment storage
• atomic approval decisions
• governance policy evaluation and credential cleanup
• installation and service configuration

Please report unsafe defaults, credential leaks, or privilege boundary issues.

Version 0.4.1 fails closed when a job requests sandbox, filesystem, network, or agent cost controls that the selected executor cannot enforce. The default host executor does not claim container, namespace, firewall, filesystem, or cost metering isolation. A restrictive contract is denied rather than simulated. Unknown sandbox or network object keys are also treated as restrictive so a misspelled or newer policy shape cannot silently become unrestricted.

Fresh shell jobs receive a minimal environment. shell_env_policy: "inherit" exposes the dispatcher environment and should be limited to reviewed legacy jobs. Materialized task credentials are cleared during cleanup paths. Provider cleanup is retried before terminal bookkeeping. Exhausted cleanup is recorded as an operator-visible run error and disables the job without re-executing its user command.

User-authored trigger regexes run through a linear-time RE2-compatible engine with bounded input and no native regular-expression fallback. Agent identifiers, session keys, and session-store paths are validated again at each storage or Gateway boundary. Installer service commands use argument arrays, and generated service configuration rejects syntax-breaking control characters.

Cancellation fencing prevents a stale dispatcher from committing scheduler state after cancellation, but it cannot reverse an external side effect that already completed. Destructive commands still need their own idempotency and precondition checks.

Crash recovery verifies the persisted operating-system process creation identity before signaling a process group. Replay occurs only after process or agent termination is confirmed and after an atomic run transition. If either condition cannot be proved, the run becomes recovery_blocked and the job is disabled for operator review.

• Acknowledgment: within 7 days of receipt.
• Resolution: within 30--90 days depending on severity and complexity.