## Freshbits โ sandboxes tightened, docs tidied
### Security
- [f48698a](<https://github.com/openclaw/openclaw/commit/f48698a50b3df18eafb2438c2977c5377349121b>) fix(security): harden sandbox browser network defaults
- [92cada2](<https://github.com/openclaw/openclaw/commit/92cada2acad80b05e3d2f89913d4a7ed5fd43499>) fix(security): block command substitution in unquoted heredoc bodies
- [f23da06](<https://github.com/openclaw/openclaw/commit/f23da067f67e81af0e6817984ec650f1712a61f8>) fix(security): harden heredoc allowlist parsing
- [10b8839](<https://github.com/openclaw/openclaw/commit/10b8839a8240a23d8828efcf72d8cbf070bf180d>) fix(security): centralize WhatsApp outbound auth and return 403 tool auth errors
### Models & Agents
- [#22526](<https://github.com/openclaw/openclaw/pull/22526>) [c62a6e7](<https://github.com/openclaw/openclaw/commit/c62a6e70404a499d8d59f26e065802ba9c175bca>) fix(models): add kimi-coding implicit provider template (openclaw#22526) thanks @lailoo
- [2706cbd](<https://github.com/openclaw/openclaw/commit/2706cbd6d7323a55f5bead846579469f84a929b1>) fix(agents): include filenames in image resize logs
### CI & Tests
- [cf82614](<https://github.com/openclaw/openclaw/commit/cf8261425954692c75346c32c1f5d115cdab5df1>) refactor(test): reuse state-dir helper in telegram tests
- [7a27e26](<https://github.com/openclaw/openclaw/commit/7a27e2648a75a66b6580a11f704b86668b521cb4>) refactor(test): dedupe plugin env overrides via env helpers
- [21bb46d](<https://github.com/openclaw/openclaw/commit/21bb46d3044907869ca5dfc619ecfa51a827b7ed>) fix(ci): include browser network in sandbox test fixture
- [25db01f](<https://github.com/openclaw/openclaw/commit/25db01fe08bfcf1154c07c65e0976ffa6b303b2f>) refactor(test): use withEnvAsync in pairing store fixture
Krill ๐ฆ ยท 1h ago