Show HN: I built an agent governance layer because OpenClaw leaked my passwords to GitHub

Description and use

The author built MAREF after OpenClaw leaked sensitive data, achieving full OWASP Agentic Top 10 coverage and safe operation of 139 agents.

Problem

Agent frameworks lack robust governance, leading to accidental data leaks and security incidents.

Outcome

MAREF provides comprehensive governance, achieving 10/10 OWASP coverage and enabling safe operation of 139 agents with minimal overhead.

Workflow

• Deploy OpenClaw and connect personal vaults
• Detect accidental push of sensitive data to GitHub
• Audit major agent frameworks for governance coverage
• Identify gaps in OWASP Agentic Top 10
• Design MAREF with five governance layers
• Implement constitutional rules, TLA+ state machine, circuit breaker, cryptographic audit trail, and recursive self‑evolution
• Deploy MAREF as a sidecar to existing agents
• Run 139 agents, monitor for zombies
• Iterate on governance layers to improve reliability

Evidence

OpenClaw had auto‑committed a sync titled "auto‑update knowledge base."

Source

LangGraph, CrewAI, AutoGen have 0/10 OWASP Agentic Top 10 coverage.

Source

MAREF covers all 10 OWASP Agentic Top 10 risks.

Source