Our 12-point audit covers: SSH key-only auth, fail2ban configuration, UFW firewall rules, Docker/Podman sandboxing, reverse proxy with TLS, environment variable encryption, network isolation, log monitoring, automatic security updates, vulnerability scanning, backup encryption, and access control lists. Two of these matter more than the rest because OpenClaw's own security guide says so: tools run on the host for the main session unless you configure sandboxing, and inbound messages must be treated as untrusted input (DM-capable channels pair unknown senders by default). We configure both.