fix(openclaw): contextualize managed audit findings

docs/security/best-practices.mdx

@@ -643,10 +643,10 @@ Device authentication requires each connecting device to go through a pairing fl
 
 | Aspect | Detail |
 |---|---|
-| Default | Enabled. The gateway requires device pairing for all connections. |
-| What you can change | Set `NEMOCLAW_DISABLE_DEVICE_AUTH=1` as a Docker build argument to disable device authentication. This is a build-time setting baked into `openclaw.json` and verified by hash at startup. |
+| Default | Enabled for loopback dashboards. NemoClaw disables device authentication for non-loopback `CHAT_UI_URL` values and when `NEMOCLAW_DISABLE_DEVICE_AUTH=1`. |
+| What you can change | Use a loopback `CHAT_UI_URL` to retain device authentication. Set `NEMOCLAW_DISABLE_DEVICE_AUTH=1` only as a deliberate build-time opt-out. The setting is baked into `openclaw.json` and verified by hash at startup. |
 | Risk if relaxed | Disabling device auth allows any device on the network to connect to the gateway without proving identity. This is dangerous when combined with LAN-bind changes or cloudflared tunnels in remote deployments, resulting in an unauthenticated, publicly reachable dashboard. |
-| Recommendation | Keep device auth enabled (the default). Only disable it for headless or development environments where no untrusted devices can reach the gateway. |
+| Recommendation | Prefer loopback access or SSH port forwarding so device authentication stays enabled. If a browser-only remote dashboard requires the compatibility setting, use HTTPS and restrict who can reach the dashboard. |
 
 ### Gateway Bind Address
 
@@ -683,6 +683,20 @@ The `allowInsecureAuth` setting controls whether the gateway permits non-HTTPS a
 | Risk if relaxed | Allowing insecure auth over HTTPS defeats the purpose of TLS, because authentication tokens transit in cleartext. |
 | Recommendation | Use `https://` for any deployment accessible beyond `localhost`. The default local URL (`http://127.0.0.1:18789`) correctly allows insecure auth for local development. |
 
+OpenClaw's security audit keeps NemoClaw-managed `allowInsecureAuth` and `dangerouslyDisableDeviceAuth` findings visible as accepted findings instead of counting them as unexplained active findings.
+The generated configuration uses exact audit check IDs and flag details, records why each setting is present, and leaves the original severity and remediation under `suppressedFindings` in JSON output.
+The audit also reports that suppressions are active so you can review the accepted risk.
+These suppressions change audit reporting only.
+They do not make either flag safe, weaken enforcement, or suppress unrelated findings.
+
+Review the accepted findings and their recorded reasons:
+
+```bash
+openclaw security audit --json | jq '.suppressedFindings'
+```
+
+Remove the underlying risky condition when dashboard compatibility no longer requires it.
+
 ### Auto-Pair Client Allowlist
 
 The auto-pair watcher automatically approves device pairing requests from recognized clients, so you do not need to manually approve the Control UI.

scripts/generate-openclaw-config.mts

@@ -1192,6 +1192,31 @@ export function buildConfig(env: Env = process.env): JsonObject {
   const isRemote = !isLoopback(parsed.hostname || "");
   const disableDeviceAuth = env.NEMOCLAW_DISABLE_DEVICE_AUTH === "1" || isRemote;
   const allowInsecure = parsed.scheme === "http";
+  const securityAuditSuppressions: JsonObject[] = [];
+  if (allowInsecure) {
+    const reason =
+      "NemoClaw derives this setting from an HTTP CHAT_UI_URL; use HTTPS for non-loopback dashboards.";
+    securityAuditSuppressions.push(
+      { checkId: "gateway.control_ui.insecure_auth", reason },
+      {
+        checkId: "config.insecure_or_dangerous_flags",
+        detailIncludes: "gateway.controlUi.allowInsecureAuth=true",
+        reason,
+      },
+    );
+  }
+  if (disableDeviceAuth) {
+    const reason =
+      "NemoClaw enables this compatibility setting for non-loopback or explicitly opted-out dashboards; use loopback access to retain device authentication.";
+    securityAuditSuppressions.push(
+      { checkId: "gateway.control_ui.device_auth_disabled", reason },
+      {
+        checkId: "config.insecure_or_dangerous_flags",
+        detailIncludes: "gateway.controlUi.dangerouslyDisableDeviceAuth=true",
+        reason,
+      },
+    );
+  }
 
   const providerModels: JsonObject[] = [
     {
@@ -1311,6 +1336,9 @@ export function buildConfig(env: Env = process.env): JsonObject {
     channels: { defaults: {} },
     tools: openclawTools,
     update: { checkOnStart: false },
+    ...(securityAuditSuppressions.length > 0
+      ? { security: { audit: { suppressions: securityAuditSuppressions } } }
+      : {}),
     plugins,
     gateway: {
       mode: "local",

test/generate-openclaw-config-security-audit.test.ts

@@ -0,0 +1,65 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import { buildConfig } from "../scripts/generate-openclaw-config.mts";
+
+const BASE_ENV: Record<string, string> = {
+  NEMOCLAW_MODEL: "test-model",
+  NEMOCLAW_PROVIDER_KEY: "test-provider",
+  NEMOCLAW_PRIMARY_MODEL_REF: "test-ref",
+  NEMOCLAW_INFERENCE_BASE_URL: "http://localhost:8080",
+  NEMOCLAW_INFERENCE_API: "openai",
+};
+
+function buildSecurityAuditConfig(chatUiUrl: string): any {
+  return buildConfig({ ...BASE_ENV, CHAT_UI_URL: chatUiUrl });
+}
+
+describe("generate-openclaw-config.mts: managed security audit findings", () => {
+  it("explains NemoClaw-managed insecure auth findings (#6024)", () => {
+    const config = buildSecurityAuditConfig("http://127.0.0.1:18789");
+    expect(config.security.audit.suppressions).toEqual([
+      {
+        checkId: "gateway.control_ui.insecure_auth",
+        reason:
+          "NemoClaw derives this setting from an HTTP CHAT_UI_URL; use HTTPS for non-loopback dashboards.",
+      },
+      {
+        checkId: "config.insecure_or_dangerous_flags",
+        detailIncludes: "gateway.controlUi.allowInsecureAuth=true",
+        reason:
+          "NemoClaw derives this setting from an HTTP CHAT_UI_URL; use HTTPS for non-loopback dashboards.",
+      },
+    ]);
+  });
+
+  it("explains NemoClaw-managed device auth findings (#6024)", () => {
+    const config = buildSecurityAuditConfig("https://nemoclaw0-xxx.brevlab.com:18789");
+    expect(config.security.audit.suppressions).toEqual([
+      {
+        checkId: "gateway.control_ui.device_auth_disabled",
+        reason:
+          "NemoClaw enables this compatibility setting for non-loopback or explicitly opted-out dashboards; use loopback access to retain device authentication.",
+      },
+      {
+        checkId: "config.insecure_or_dangerous_flags",
+        detailIncludes: "gateway.controlUi.dangerouslyDisableDeviceAuth=true",
+        reason:
+          "NemoClaw enables this compatibility setting for non-loopback or explicitly opted-out dashboards; use loopback access to retain device authentication.",
+      },
+    ]);
+  });
+
+  it("explains both managed flags for a non-loopback HTTP dashboard (#6024)", () => {
+    const config = buildSecurityAuditConfig("http://remote.example:18789");
+    expect(config.security.audit.suppressions).toHaveLength(4);
+    expect(config.security.audit.suppressions.map((entry: any) => entry.checkId)).toEqual([
+      "gateway.control_ui.insecure_auth",
+      "config.insecure_or_dangerous_flags",
+      "gateway.control_ui.device_auth_disabled",
+      "config.insecure_or_dangerous_flags",
+    ]);
+  });
+});