Skip to content

docs: standardize Python SDK vulnerability disclosure policy #3642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HAYDEN-OAI merged 3 commits into from
Aug 19, 2026
+26 −10
Merged

docs: standardize Python SDK vulnerability disclosure policy #3642

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e2af4b7
docs: standardize Python SDK vulnerability disclosure policy
HAYDEN-OAI Aug 17, 2026
a6ff790
docs: clarify security report commits and disclosure terms
HAYDEN-OAI Aug 18, 2026
4e18249
Merge branch 'main' into codex/openai-python-security-policy-standard…
HAYDEN-OAI Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 26 additions & 10 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,34 @@
# Security Policy

## Reporting Security Issues
## Reporting a vulnerability

Please report potential security vulnerabilities through OpenAI's
Please report potential security vulnerabilities privately through OpenAI's
[coordinated vulnerability disclosure process](https://openai.com/policies/coordinated-vulnerability-disclosure-policy).
For questions about that process, contact disclosure@openai.com.

Do not report vulnerabilities through public GitHub issues, discussions, pull
requests, or other public channels. When reporting privately, include the
affected SDK version, impact, and reproduction steps where possible; redact API
keys, authentication headers, private keys, and customer data from all reports.
This policy applies to the source code in this repository and the official
[`openai` Python package](https://pypi.org/project/openai/), including its
published source distributions and wheels.

## Responsible Disclosure
Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Please allow OpenAI a reasonable amount of time to investigate and address the
issue before making information public. Thank you for helping us keep this SDK
and the systems it interacts with secure.
## What to include

- The affected package or product and version, or the relevant source commit.
- A clear description of the security impact.
- Sanitized steps to reproduce the issue.

For the `openai` Python package, include the Python version, operating system,
and affected source distribution or wheel when relevant.

Do not include live credentials, API keys, customer data, or unredacted sensitive logs.

Redact authentication headers and private keys, and replace other secrets with
clearly fake values.

## Coordinated disclosure

Follow the linked coordinated-disclosure terms, and keep vulnerability details
confidential until their release is coordinated with or authorized by OpenAI.

Thank you for helping us keep this SDK and the systems it interacts with secure.
Loading