OpenClaw versions up to 2026.3.28 have a vulnerability where the Nostr privateKey is modeled as a plain string, allowing config views to expose the plaintext signing key via config.get. This redaction bypass leaks sensitive private key material. The issue is fixed in version 2026.3.31.