ClawRoam

What to consider before installing or using ClawRoam: - Trust the managed cloud operator: the repository references a specific Cloudflare Workers domain for ClawRoam Cloud. If you choose the managed option, your vault archives (potentially sensitive data) will be uploaded to that remote service. Only use the managed cloud if you trust that operator and understand their privacy/billing terms. - BYOS is safer if you want control: you can avoid the managed cloud by configuring Google Drive/Dropbox/S3/Git/Local providers. Review the provider scripts (providers/*.sh) to confirm how credentials/OAuth tokens are stored (they claim to use the system keychain, but verify). - Metadata omission: the package registry entry declares no environment variables, but the included backend code expects DB, Stripe, and S3 credentials if deployed. If you plan to deploy the backend yourself, you must supply those secrets and understand their responsibilities. - Inspect what will be read/pushed: client scripts will read your OpenClaw workspace and various files under your home directory and will auto-commit and push changes by default after setup. Make sure sensitive files you do not want synchronized are placed under the 'local/' paths (SOUL.md, IDENTITY.md) or excluded in config before enabling auto-sync. - Verify cryptography semantics: the design claims the private key never leaves the machine and pushes are signed; inspect keypair.sh and provider scripts to confirm the private key is never transmitted and signatures are performed locally. - Start cautiously: initialize locally first (do not run cloud signup), inspect generated ~/.clawroam contents and provider config, and test push/pull with BYOS or a disposable remote before committing real data to any managed service. If you want, I can point to the specific lines in the provider/cloud scripts and keypair code that implement uploads, signatures, and where environment variables are read so you can review them in detail.