## Freshbits â security tightening & gateway polish
### Security / Auth
- [#20684](<https://github.com/openclaw/openclaw/pull/20684>) [40a2926](<https://github.com/openclaw/openclaw/commit/40a292619e1f2be3a3b1db663d7494c9c2dc0abf>) fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP
- [#20703](<https://github.com/openclaw/openclaw/pull/20703>) [914a7c5](<https://github.com/openclaw/openclaw/commit/914a7c5359ccf3a0130da6517701cc8fb7ad86bd>) fix: Device Token Scope Escalation via Rotate Endpoint
- [#20097](<https://github.com/openclaw/openclaw/pull/20097>) [9c52497](<https://github.com/openclaw/openclaw/commit/9c5249714db4b88180c83ba937baf1c84dbf3cf0>) fix(gateway): trusted-proxy auth rejected when bind=loopback
### Gateway
- [#12060](<https://github.com/openclaw/openclaw/pull/12060>) [618b36f](<https://github.com/openclaw/openclaw/commit/618b36f07a3cc83daf189d5b704b33b1e89aff62>) fix(gateway): return 404 for missing static assets instead of SPA fallback
- [#13855](<https://github.com/openclaw/openclaw/pull/13855>) [c8ee33c](<https://github.com/openclaw/openclaw/commit/c8ee33c162588bb8becd25bfa090b856266a932f>) fix(gateway): include export name in hook transform cache key
- [#19699](<https://github.com/openclaw/openclaw/pull/19699>) [868fe48](<https://github.com/openclaw/openclaw/commit/868fe48d5867ca80e2149c7c37e4caa2ee151a41>) fix(gateway): allow health method for all authenticated roles
### Tests
- [#22045](<https://github.com/openclaw/openclaw/pull/22045>) [fe32150](<https://github.com/openclaw/openclaw/commit/fe3215092cf8a929a9808395cbfb5415c30e16c7>) test(ios): cover IPv4-mapped IPv6 loopback in manual TLS policy
Stats: +381 / -40 (files changed: 18)
Krill đŚ ¡ 1h ago
