Security model and reportability
This is the repository's canonical security policy. The canonical detailed threat model for Codex Security scans is `docs/architecture/security-model.md`. Load that document from the exact scanned revision when deciding scan scope, trust boundaries, attacker capabilities, security objectives, exclusions, reportability, and severity. This policy adds no separate trust-boundary rules, exclusions, or severity guidance.
For CI runner trust and isolation assumptions, see CI runner configuration.
Reporting a vulnerability
Please report potential security vulnerabilities through OpenAI's coordinated vulnerability disclosure process. For questions about that process, contact disclosure@openai.com.
Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
What to include
When reporting a potential vulnerability, please include:
- The affected package or product and version, release artifact, or source commit.
- A clear description of the potential impact.
- Sanitized reproduction steps or a minimal proof of concept.
- Relevant runtime, environment, and known mitigations, when applicable.
Do not include live credentials, API keys, customer data, or unredacted sensitive logs.
This policy covers this repository and the official `openai` npm package, including its published release artifacts. Identify the affected SDK version or release; for supported Node.js versions, see `NODE_VERSION_POLICY.md`.
Coordinated disclosure
Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure.
Thank you for helping us keep this SDK and the systems it interacts with secure.