Dev iconDevSep 30, 2026 ~1 min source read

Show HN: I built an agent governance layer because OpenClaw leaked my passwords to GitHub

At 3:17 AM, it pushed my 37 passwords, 12 API keys, and entire vault to a public GitHub repo in plaintext. Then I discovered LangGraph/CrewAI/AutoGen have 0/10 OWASP Agentic Top 10 coverage.

Show HN: I built an agent governance layer because OpenClaw leaked my passwords to GitHub
Read original More from Dev

Share this story

Send the public story page.

Useful takeaways from this story.

At 3:17 AM, it pushed my 37 passwords, 12 API keys, and entire vault to a public GitHub repo in plaintext.

Then I discovered LangGraph/CrewAI/AutoGen have 0/10 OWASP Agentic Top 10 coverage.

Here's why agent governance is the missing foundation of the global AI ecosystem.

Building the complete brief

The page is ready to read now. The fuller skim-friendly version will appear here automatically.

The useful part

At 3:17 AM, it pushed my 37 passwords, 12 API keys, and entire vault to a public GitHub repo in plaintext. Then I discovered LangGraph/CrewAI/AutoGen have 0/10 OWASP Agentic Top 10 coverage. Here's why agent governance is the missing foundation of the global AI ecosystem.

How it works

  • Framework Native Governance OWASP Agentic Top 10 LangGraph Checkpointing (state persistence) 0/10 CrewAI human_input=True (boolean flag) 0/10</...
  • Major Frameworks Score 0/10 on Governance I audited every major framework:
  • Browser automation, file I/O, API calls, complex task execution — looked mature.
  • OpenClaw had auto-committed a sync titled "auto-update knowledge base." That commit contained:
  • Full plaintext export of my Obsidian vault 37 website passwords (banks, payments, cloud services) 12 cloud API keys Internal project configs All pushed to a public GitHub repo.

What to take from it

So I built MAREF — an agent governance OS that covers all 10 risks.

Details worth keeping

The Incident: A 3:17 AM GitHub Security Alert December 2025. I found OpenClaw (then called Clawdbot) on GitHub. Connected my Obsidian vault, email, browser, and phone via ADB.

Keep reading in the app

Open the app view to save this story, compare related coverage, and continue from the same source.

Open in app