Credential Hygiene Validator

Checks whether credentials and tokens in config files are stored
with reasonable hygiene. Catches common mistakes before they become
incidents.

What it checks

1. 1. File permissions -- config files should be 600 or 700, not world-readable
2. Plaintext tokens -- scans for hex tokens, JWTs (base64url with dots), Bearer strings, and API keys
3. Git repo contamination -- whether the config directory sits inside a git working tree
4. Gitignore coverage -- whether .gitignore excludes credential paths
5. Log file leaks -- tokens appearing in log output (checks all formats: hex, JWT, Bearer per RFC 6750)
6. Token age -- warns if tokens have not been rotated recently
7. Atomic write safety -- checks if config backup exists (indicator of safe write patterns)

When to use it

• - After setting up a new tool or service
• Before pushing dotfiles to a public repo
• As part of a regular security hygiene review
• When onboarding a new machine
• After rotating credentials, to confirm the old token is gone

Example prompts

• - "Check if my OpenClaw tokens are stored safely"
• "Audit my dotfiles for leaked credentials"
• "Is my config directory in a git repo?"
• "Check file permissions on my credentials"
• "Are my tokens showing up in any log files?"

Checks run

CODEBLOCK0

Notes

• - Read-only checks, does not modify any files
• Token patterns match hex, JWT (header.payload.signature), base64url,

• - Works with any tool that stores credentials in dotfiles
• Aligns with T-ACCESS-003 in the OpenClaw threat model

References

• - OpenClaw threat model (T-ACCESS-003)
• OpenClaw security policy
• RFC 6750 - Bearer Token Usage