Security

Local by default. Explicit about the edges.

The supplied deployment is a single-user, loopback-only search backend. It includes process sandboxing and no API credentials, but it does not include TLS, authentication, or a prompt-injection classifier. Those boundaries belong to the reverse proxy and to OpenClaw's agent controls.

Bind127.0.0.1:8080
Service usersearxng
API keysNone
TLS / authNot included

Loopback

Not reachable remotely

SearXNG and Redis listen on 127.0.0.1. The installer does not open a firewall port or configure a public hostname.

Unprivileged

No root service

The unit runs as searxng with NoNewPrivileges, ProtectSystem=strict, ProtectHome, and PrivateTmp.

Keyless

No search credentials

No commercial search API key is stored. The only generated secret is SearXNG's secret_key, created on the host.

Not public-ready

No auth or TLS

There is no login, certificate, rate limiter, or multi-tenant isolation. Do not expose the port as-is.

Exposure map

What is listening, and who can reach it.

Surface	Default exposure	Data at risk	Control
SearXNG HTTP	`127.0.0.1:8080`	Queries, cached results, configuration UI	Loopback bind; add TLS/auth before exposure
Redis	`127.0.0.1:6379`	Cached responses	Loopback bind; optional `requirepass`
systemd unit	Local root	Service execution	Unprivileged user, sandboxing directives
`openclaw.json`	User home	Plugin config, other agent settings	File permissions; backup handling
Backups	User home	`settings.yml`, `openclaw.json`, optional Redis password	Protect as secrets
Outbound requests	Enabled engines	Server IP, query text, request timing	Choose engines; use a network egress policy if needed

Prompt injection

Search results are data, not instructions.

A result title, snippet, or page can contain text aimed at the model. The relevant protection is the way OpenClaw wraps and sanitizes external content before it enters the context window. This repository keeps that content on the JSON path and on loopback, but it does not replace the agent's tool policy.

The boundary layer

OpenClaw places web search and fetch output inside marked untrusted blocks with a random identifier:

<<<EXTERNAL_UNTRUSTED_CONTENT id="a1b2c3d4e5f60718">>>
Source: Web Search
...result content...
<<<END_EXTERNAL_UNTRUSTED_CONTENT id="a1b2c3d4e5f60718">>>

The random id makes forged closing markers harder. OpenClaw also strips chat-template special tokens (ChatML, Llama, Gemma, Mistral, Phi, GPT-OSS, and similar) so an attacker cannot forge role boundaries or fake system turns.

The sample above illustrates the marker format; the id is generated per block.

What this repository adds

Uses SearXNG's JSON endpoint instead of scraping arbitrary HTML into the agent context.
Binds the service to loopback, so remote clients cannot query it directly.
Enables a small default engine set, reducing exposure to any one upstream's content.
Runs the service unprivileged with systemd sandboxing.
Stores no commercial API keys in the repo.

What it does not do

It does not classify injected text itself.
It does not sandbox tool execution.
It does not stop a user pasting hostile content into chat.
It does not make the host anonymous to upstream engines.

Wrapping is one layer, not the whole policy.

OpenClaw's own guidance is to keep external-content wrapping enabled and to pair it with channel allowlists, tool allowlists, exec approvals, sandboxing, and a capable model. The wrapping does not replace those controls.

OpenClaw prompt-injection guide

Privacy

Private to your host, not anonymous on the wire.

SearXNG does not log queries, create accounts, or build user profiles by default. Results are cached temporarily in local Redis. That protects you from a search vendor's account-level profiling and keeps the query history on hardware you control.

It does not hide your server from the engines. Every enabled engine sees an HTTP request from your host's IP address with the query text. If anonymity is the requirement, this stack is not sufficient; use a network designed for it.

image_proxy: true proxies remote images through SearXNG, so image hosts see the server rather than the browser. It costs bandwidth and server CPU.

Do not claim

Common overstatements

"No one can see your searches." Upstream engines can.
"It is anonymous." It is not a Tor or VPN substitute.
"It is secure to expose." The supplied config has no auth or TLS.
"It cannot be prompt-injected." No wrapper guarantees that.

Hardening checklist

Keep the default posture, or do the extra work.

Keep bind_address: 127.0.0.1; do not port-forward 8080.
Keep Redis on loopback; set requirepass if other local users exist.
Keep the limiter off only while loopback-bound.
Use a generated secret_key; do not reuse the sample.
Protect ~/searxng-backups; archives can contain secrets.
Restrict OpenClaw's exec, browser, web_fetch, and web_search tools to agents that need them.
Keep external-content wrapping enabled and leave unsafe-content bypass flags off.
Update SearXNG monthly and after engine breakage.

Before exposing the service beyond loopback

Add a reverse proxy with TLS, authentication, and request limits. Enable SearXNG's limiter and tune limiter.toml. Restrict inbound traffic with a firewall. Keep Redis private and password-protected. Re-read the SearXNG documentation for the version you run. None of these steps are automated by this repository.

Reporting

Found a problem?

Report vulnerabilities privately through GitHub's security advisory flow. Do not open a public issue before a fix is available.

Report a vulnerability Security policy

Scope

What belongs here

Scripts, templates, generated site, and documentation in this repository. Report SearXNG, OpenClaw, Redis, systemd, and upstream engine bugs to those projects; this repo can document a mitigation.

Include the distribution, OpenClaw version, reproduction steps, and impact. Redact tokens and public IPs.