Improve README security section

Author: romgenie

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.2 - 2026-05-26
+
+- Improved the README security section for clearer ClawHub rendering and operator guidance.
+
 ## 0.1.1 - 2026-05-26
 
 - Updated ClawHub release tags for better package discovery.

README.md

@@ -59,31 +59,25 @@ Environment fallbacks are also supported: `MAUTIC_BASE_URL`, `MAUTIC_CONSOLE_URL
 
 ## Security Model
 
-Production defaults are restrictive:
+The plugin ships with conservative production defaults. Installing it does not automatically grant file access or operational Mautic job control.
 
-- Maintenance commands are disabled.
-- Automation job commands are disabled.
-- Workspace read/write access is disabled.
-- API requests are restricted to `/api` and `/api/v2`.
-- Workspace file paths must remain inside `allowedWorkspaceRoot`.
-- Console commands are intersected with a hardcoded allowlist before execution.
-
-The only console command available without extra capability toggles is `migrations:status`.
-
-`allowMaintenanceCommands` enables:
-
-- `cache:clear`
-- `mautic:cache:clear`
-- `plugins:reload`
+| Area | Default | Guardrail |
+| --- | --- | --- |
+| Mautic API | Enabled after credentials are provided | Requests are limited to `/api` and `/api/v2`. |
+| Console status | Enabled only for `migrations:status` | Useful for health checks without granting maintenance control. |
+| Maintenance commands | Disabled | Requires `allowMaintenanceCommands=true`. |
+| Automation jobs | Disabled | Requires `allowAutomationJobCommands=true`. |
+| Workspace files | Disabled | Read and write require separate opt-in toggles. |
+| Path access | Guarded | File paths must stay inside `allowedWorkspaceRoot`. |
 
-`allowAutomationJobCommands` enables:
+Enable capabilities only for operators and agents you trust with that scope.
 
-- `webhooks:process`
-- `campaigns:rebuild`
-- `campaigns:trigger`
-- `segments:update`
+| Toggle | Commands Enabled | When To Use |
+| --- | --- | --- |
+| `allowMaintenanceCommands` | `cache:clear`, `mautic:cache:clear`, `plugins:reload` | Routine maintenance after plugin/config/cache changes. |
+| `allowAutomationJobCommands` | `webhooks:process`, `campaigns:rebuild`, `campaigns:trigger`, `segments:update` | Intentional campaign, segment, and webhook job execution. |
 
-Use restrictive OpenClaw profiles or explicit tool allowlists for agents that process untrusted input.
+Console requests are checked twice: first by the plugin's hardcoded allowlist, then by the optional bridge's allowlist. For agents that process untrusted input, use restrictive OpenClaw profiles or explicit tool allowlists.
 
 ## Console Bridge
 

docs/CLAWHUB_READINESS.md

@@ -48,7 +48,7 @@ Result:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.1"
+  "version": "0.1.2"
 }
 ```
 
@@ -67,7 +67,7 @@ Result: passed. ClawHub detected:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.1"
+  "version": "0.1.2"
 }
 ```
 

docs/PRIVATE_SOURCE_REVIEW_REQUEST.md

@@ -6,7 +6,7 @@ Historical/alternate handoff only. The repository is currently public, so this p
 
 - Package name: `@completetech/openclaw-mautic-plugin`
 - Plugin id: `mautic-control`
-- Version: `0.1.1`
+- Version: `0.1.2`
 - Source repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Current source visibility: public
 - Branch: `main`

openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "mautic-control",
   "name": "Mautic Control",
   "description": "Typed tools for controlled Mautic REST API access, webhook inspection, optional console maintenance, and optional workspace file staging.",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "contracts": {
     "tools": [
       "mautic_status",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@completetech/openclaw-mautic-plugin",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "OpenClaw plugin for controlled Mautic API, webhook, console bridge, and workspace operations.",
   "type": "module",
   "private": false,