Three Things Your LLM App Should Have Done on Day One (But Probably Didn't)

You spent a weekend wiring up RAG, connecting MCP, and deploying an LLM Agent that auto-replies to GitHub Issues — then shipped it straight to production. No input validation, no permission controls, system prompt wide open. Don't worry, everyone does it. No security background needed to follow along — we'll open a terminal and show you live. This talk covers three things you should do before going live: First, protect your system prompt — we'll steal it with prompt injection, then block the attack with NemoClaw Guardrail. Second, sanitize your RAG data sources — we'll plant an indirect prompt injection in a knowledge base document and make your Agent do things it shouldn't, then show how content sanitization works. Third, limit your Agent's permissions — we'll let an over-privileged Agent delete its own data, then fix it with least-privilege principles and tool call permission controls. Every attack uses OpenClaw, every fix uses NemoClaw — all open source, git clone and go. You'll leave with a security checklist ready to drop into your repo.