Docs: merge remaining channel support notes

docs/FAQ.md

@@ -51,3 +51,12 @@ That said, your local OpenClaw config contains sensitive information. Follow the
 - don't share raw screenshots without redaction
 
 See: `docs/SECURITY.md`.
+
+
+## Q: 为什么 OCM 暂时不推荐 WhatsApp 的 sub-agent 工作流？
+
+WhatsApp 在 bot / group 自动化、权限边界和稳定路由上限制更多。
+
+OCM 的 sub-agent 模式依赖清晰的会话边界、独立路由和可控权限，因此目前更推荐 Telegram / Discord 这类更容易做隔离的渠道。
+
+如果未来支持 WhatsApp，更可能先从通知或轻量交互开始，而不是多 sub-agent 群聊拓扑。

docs/SECURITY.md

@@ -28,3 +28,25 @@ If you share screenshots publicly:
 - blur any tokens/keys if visible
 
 This repo contains **redacted + annotated** screenshots under `docs/annotated-screenshots/`.
+
+
+## Discord safety
+
+Recommended defaults (especially for shared/community servers):
+
+- Prefer **private channels / private threads** as agent boundaries
+- Use a strict **allowlist** of channels/threads the bot may respond in
+- Avoid giving memory-enabled or high-privilege agents broad public exposure
+- Prefer least-privilege Discord permissions for the bot
+
+## Feishu / Lark safety
+
+Feishu is more enterprise-oriented and usually needs stricter permission design:
+
+- Request the smallest permission scope possible
+- Treat chat/group visibility as a security boundary
+- Prefer separate chats/spaces for different agents to reduce context bleed
+
+## WhatsApp note
+
+WhatsApp is not a recommended target for sub-agent topology workflows. Constraints in bot/group automation make reliable multi-agent isolation and routing harder.