Security Model

Defense-in-depth across gateway access, secret storage, memory, and trading.

DragonClaw is designed to be private by default.

Its security model assumes the agent runs on infrastructure you control.

Core principles

• Local-first data storage

• Explicit gateway authentication

• Layered rate limiting

• Least-privilege API keys

• Confirmation before trading

• No withdrawal support

Main controls

1. Gateway token auth

2. Nginx edge protection

3. Local bind by default

4. Structured validation for incoming requests

5. Encrypted secrets at rest

6. Persistent but local memory storage

Security boundary

DragonClaw only sends data out when a provider call, exchange call, or user skill requires it.

Everything else stays inside your own runtime and storage.