Security
v2026.5.22-beta.1 arrived on 2026-05-23 with a change that matters during maintenance: documentation update. The page is a researched reading note from the official release record, with a test path for a real Gateway.
Because this is a pre-release, use a disposable Gateway first and leave the stable version available for comparison. The release body cannot certify every local combination of provider, channel, platform, and account; use the bounded test below for the path you actually run.
Channel
Pre-Release
Primary signals
Documentation update; Agents/tools; StepFun
Publication date
2026-05-23
Before the package changes
Documentation update
Evidence from the release. clarify README onboarding and Gateway startup paths, WhatsApp QR/408 recovery, cron output language prompts, skill advanced features, gateway upstream 403 troubleshooting, and plugin fallback override guidance.
Operator reading. Documentation update lives at the handoff between the Gateway and a conversation. Send one harmless message, reconnect once, and compare the account, thread, sender, and final transcript.
Documentation update
Evidence from the release. clarify context-pruning ratio bounds, local dashboard recovery, CLI env markers, remote onboarding token behavior, and Peekaboo Bridge permissions for subprocess agents.
Operator reading. Before widening access for Documentation update, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.
Documentation update
Evidence from the release. clarify browser CDP diagnostics, Plugin SDK allowlist imports, status-reaction timing defaults, queue steering behavior, limited-tool troubleshooting, cron HEARTBEAT handling, Telegram multi-agent groups, Bitwarden SecretRef setup, and EasyRunner deployments.
Operator reading. The useful evidence for Documentation update is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.
Agents/tools
Evidence from the release. honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available.
Operator reading. The safe reading of Agents/tools is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.
Details behind the headline
StepFun
stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices.
Read StepFun as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.
A bounded check for this version
- Start with a disposable checkpoint: record the version, host, provider, and workspace tied to Documentation update.
- Check the release's migration notes and make a restorable backup before changing persistent state.
- Use a disposable conversation for one send, one reconnect, and one retry; keep the destination identifiers with the result.
- Leave the channel disabled after the test if its credentials or pairing were created only for this rehearsal.
- If the result differs from the release body, stop the rollout and attach the log, screenshot, or transcript to the version record.
openclaw --version
openclaw gateway status
openclaw security auditClose the loop with evidence
A useful maintenance record names the changed behavior, the behavior that stayed stable, the identity that approved the test, and the step that would undo it. Preserve that record beside the release tag.
Edge cases in this tag
Agents/tools. honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available. Record the failure that this correction addresses before declaring the upgrade complete.
StepFun. stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices. This is the edge case to include in a regression check, especially when the release is pre-release.
The authoritative record is the v2026.5.22-beta.1 GitHub release. The release index gives the surrounding sequence, while the Gateway security guide supplies the operational background.
Reference Trail
Sources and further reading
- v2026.5.22-beta.1 GitHub releasegithub.com
- release indexgithub.com
- Gateway security guidedocs.openclaw.ai