From 70a87606eaadf8821a072f1588af8689e938d0b1 Mon Sep 17 00:00:00 2001
From: Arjun Komath <arjunkomath@gmail.com>
Date: Sun, 15 Mar 2026 13:09:18 +1100
Subject: [PATCH] Add security disclaimer

---
 README.md             | 4 ++++
 src/public/setup.html | 8 ++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 648d9a4..3d111c9 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,10 @@
 
 <img width="1712" height="1376" alt="CleanShot 2026-02-23 at 21 59 21@2x" src="https://github.com/user-attachments/assets/f30ab683-dbc2-4980-ace7-152265e00c79" />
 
+## Security Notice
+
+> **This template exposes your OpenClaw gateway to the public internet.** **Please read the [OpenClaw security documentation](https://docs.openclaw.ai/gateway/security) before deploying** to understand the risks and recommended configuration. If you only use chat channels (Telegram, Discord, Slack) and don't need the gateway dashboard, you can remove the public endpoint from Railway after setup.
+
 ## What you get
 
 - **OpenClaw Gateway + Control UI** (served at `/` and `/openclaw`)
diff --git a/src/public/setup.html b/src/public/setup.html
index 151bbbd..2375194 100644
--- a/src/public/setup.html
+++ b/src/public/setup.html
@@ -343,8 +343,12 @@
         <img src="https://raw.githubusercontent.com/openclaw/openclaw/main/docs/assets/openclaw-logo-text.png" alt="OpenClaw" class="logo-img">
       </picture>
     </div>
-    <h1 class="page-title">Personal AI Assistant</h1>
-    <p class="page-subtitle">Configure your AI assistant in a few simple steps</p>
+    <div style="margin-bottom:1.5rem;padding:0.75rem 1rem;border:1px solid #ef4444;border-radius:0.5rem;background:var(--bg-card)">
+      <p style="font-size:0.75rem;color:var(--text-mid);line-height:1.5;margin:0">
+        <strong style="color:#ef4444">Important:</strong> This template exposes your OpenClaw gateway to the public internet. <strong style="color:var(--text)">Please read the <a href="https://docs.openclaw.ai/gateway/security" target="_blank" style="color:var(--text);text-decoration:underline">OpenClaw security documentation</a> before deploying.</strong> If you only use chat channels (Telegram, Discord, Slack) and don't need the gateway dashboard, you can remove the public endpoint from Railway after setup.
+      </p>
+    </div>
+
 
     <div class="card card-compact mb-6">
       <div class="card-header">