• Do not commit API keys, tokens, or service credentials.
• Store secrets in environment variables or local files excluded by .gitignore.
• Use .env.example as a template only.

• shell profile files containing exported secrets
• OpenClaw runtime auth/token state files
• user service environment override files

Run:

git status
rg -n "(sk-[A-Za-z0-9]|API_KEY\\s*=|Bearer\\s+[A-Za-z0-9_-]{20,})" .
make security-check

Then confirm no real key values are present in tracked files.

cp .env.example .env
nano .env
./scripts/configure_env.sh --env-file .env --restart-gateway

This keeps real keys out of git while applying them to runtime services.