From e2af4b7461a2dd3845e571904270348d7d7e5ff2 Mon Sep 17 00:00:00 2001 From: Hayden Date: Mon, 17 Aug 2026 23:06:46 +0000 Subject: [PATCH 1/2] docs: standardize Python SDK vulnerability disclosure policy --- SECURITY.md | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index aa583877fa..67e19ab414 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,18 +1,33 @@ # Security Policy -## Reporting Security Issues +## Reporting a vulnerability -Please report potential security vulnerabilities through OpenAI's +Please report potential security vulnerabilities privately through OpenAI's [coordinated vulnerability disclosure process](https://openai.com/policies/coordinated-vulnerability-disclosure-policy). For questions about that process, contact disclosure@openai.com. -Do not report vulnerabilities through public GitHub issues, discussions, pull -requests, or other public channels. When reporting privately, include the -affected SDK version, impact, and reproduction steps where possible; redact API -keys, authentication headers, private keys, and customer data from all reports. +This policy applies to the source code in this repository and the official +[`openai` Python package](https://pypi.org/project/openai/), including its +published source distributions and wheels. -## Responsible Disclosure +Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions. -Please allow OpenAI a reasonable amount of time to investigate and address the -issue before making information public. Thank you for helping us keep this SDK -and the systems it interacts with secure. +## What to include + +- The affected package or product and version. +- A clear description of the security impact. +- Sanitized steps to reproduce the issue. + +For the `openai` Python package, include the Python version, operating system, +and affected source distribution or wheel when relevant. + +Do not include live credentials, API keys, customer data, or unredacted sensitive logs. + +Redact authentication headers and private keys, and replace other secrets with +clearly fake values. + +## Coordinated disclosure + +Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure. + +Thank you for helping us keep this SDK and the systems it interacts with secure. From a6ff7902d70c71a3fbe7208fd90016abfe1b4e63 Mon Sep 17 00:00:00 2001 From: Hayden Date: Tue, 18 Aug 2026 00:56:50 +0000 Subject: [PATCH 2/2] docs: clarify security report commits and disclosure terms --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 67e19ab414..0406a5a0e4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -14,7 +14,7 @@ Do not report security vulnerabilities through public GitHub issues, pull reques ## What to include -- The affected package or product and version. +- The affected package or product and version, or the relevant source commit. - A clear description of the security impact. - Sanitized steps to reproduce the issue. @@ -28,6 +28,7 @@ clearly fake values. ## Coordinated disclosure -Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure. +Follow the linked coordinated-disclosure terms, and keep vulnerability details +confidential until their release is coordinated with or authorized by OpenAI. Thank you for helping us keep this SDK and the systems it interacts with secure.