docs: standardize Python SDK vulnerability disclosure policy

[HAYDEN-OAI]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

• Standardize SECURITY.md on the shared public SDK policy: Reporting a vulnerability, What to include, and Coordinated disclosure.
• Use the exact shared warnings against public GitHub issues/pull requests/discussions and including live credentials, API keys, customer data, or unredacted sensitive logs.
• Preserve Python's existing coordinated-disclosure URL, disclosure@openai.com contact, authentication-header/private-key redaction, and respectful disclosure commitment.
• Document the official openai PyPI package, published source distributions/wheels, and relevant package version, Python version, operating system, impact, and sanitized reproduction details.

Verification

• CommonMark parsing and exact assertions for the three canonical headings, three shared report-detail bullets, and all three verbatim shared warning/disclosure sentences.
• Existing disclosure endpoint returned HTTP 200; disclosure URL/contact were preserved, and the PyPI URL matches the existing README and actual sdist/wheel build targets.
• Credential-like-literal, line-ending, trailing-whitespace, and Markdown-link validation.
• python scripts/check-python-version-policy.py
• git diff origin/main...HEAD --check

Additional context & links

Only the existing root SECURITY.md is changed; no private-reporting settings, workflows, package code, or unrelated policies are modified.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.398s for Python SDK PR #3642.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	144ms
tests/chat-completions-create.test.ts	✅ Passed	199ms
tests/chat-completions-stream.test.ts	✅ Passed	108ms
tests/files-content-binary.test.ts	✅ Passed	180ms
tests/files-create-multipart.test.ts	✅ Passed	243ms
tests/files-list-pagination.test.ts	✅ Passed	115ms
tests/initialize-config.test.ts	✅ Passed	149ms
tests/instance-isolation.test.ts	✅ Passed	222ms
tests/models-list.test.ts	✅ Passed	244ms
tests/responses-background-lifecycle.test.ts	✅ Passed	160ms
tests/responses-body-method-errors.test.ts	✅ Passed	261ms
tests/responses-cancel-timeout.test.ts	✅ Passed	195ms
tests/responses-cancel.test.ts	✅ Passed	136ms
tests/responses-compact-retries.test.ts	✅ Passed	213ms
tests/responses-compact.test.ts	✅ Passed	216ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	107ms
tests/responses-create-advanced.test.ts	✅ Passed	187ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.097s
tests/responses-create-errors.test.ts	✅ Passed	320ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	88ms
tests/responses-create-retries.test.ts	✅ Passed	368ms
tests/responses-create-stream-failures.test.ts	✅ Passed	111ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	183ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.958s
tests/responses-create-stream.test.ts	✅ Passed	60ms
tests/responses-create-terminal-states.test.ts	✅ Passed	176ms
tests/responses-create-timeout.test.ts	✅ Passed	188ms
tests/responses-create.test.ts	✅ Passed	293ms
tests/responses-delete.test.ts	✅ Passed	165ms
tests/responses-input-items-errors.test.ts	✅ Passed	296ms
tests/responses-input-items-list.test.ts	✅ Passed	234ms
tests/responses-input-items-options.test.ts	✅ Passed	216ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	220ms
tests/responses-input-tokens-count.test.ts	✅ Passed	188ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.195s
tests/responses-not-found-errors.test.ts	✅ Passed	184ms
tests/responses-parse.test.ts	✅ Passed	288ms
tests/responses-retrieve-retries.test.ts	✅ Passed	197ms
tests/responses-retrieve.test.ts	✅ Passed	177ms
tests/responses-stored-method-errors.test.ts	✅ Passed	493ms
tests/retry-behavior.test.ts	✅ Passed	3.225s
tests/sdk-error-shape.test.ts	✅ Passed	270ms

View OkTest run #32086424556

_{SDK merge (2b19790cf9db) · head (a6ff7902d70c) · base (6577709190ae) · OkTest (7e7850017529)}

[jbeckwith-oai]

Overview: The private reporting route, package/artifact scope, and redaction guidance are sound. Two small consistency gaps remain in the standardized policy.

[Low] Accept a source commit when no release version exists

Location: SECURITY.md:17-22

openai-python/SECURITY.md

Lines 17 to 22 in e2af4b7

	- The affected package or product and version.
	- A clear description of the security impact.
	- Sanitized steps to reproduce the issue.
	For the `openai` Python package, include the Python version, operating system,
	and affected source distribution or wheel when relevant.

The document newly covers repository source, but the report checklist only requests a package/product version and distribution format. A finding against unreleased main or another development branch may have no applicable release version, and the moving branch is not a stable reproduction target. Please change the first bullet to request the affected package/product and version, or the relevant source commit.

[Low] Match the linked confidentiality rule

Location: SECURITY.md:29-31

openai-python/SECURITY.md

Lines 29 to 31 in e2af4b7

	## Coordinated disclosure
	Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure.

The linked OpenAI process routes researchers to Bugcrowd, whose current engagement brief requires vulnerability details to remain confidential until OpenAI authorizes release. Asking only for a reasonable opportunity before public disclosure can be read as permitting unilateral release after a subjective waiting period. Please defer explicitly to the linked coordinated-disclosure terms and state that details remain confidential until release is coordinated or authorized. Keep this as a short cross-reference rather than copying a separate repository-specific timeline.

No additional actionable findings. Exact-head CI is green.