1. Insecure Authentication Configuration

File: scripts/nemoclaw-start.sh:36-40

Issue: The Gateway configuration contains insecure authentication options.

gateway['controlUi'] = {
'allowInsecureAuth': True,
'dangerouslyDisableDeviceAuth': True,
'allowedOrigins': origins,
}

Impact:

May lead to unauthorized access during production deployment.

dangerouslyDisableDeviceAuth may bypass device verification.

Combined with allowedOrigins, it may be exploited for authentication bypass.

Recommendation: Disable these options in production environments and use strict authentication mechanisms.