This is the repository's canonical security policy. The canonical detailed threat model for Codex Security scans is docs/architecture/security-model.md. Load that document from the exact scanned revision when deciding scan scope, trust boundaries, attacker capabilities, security objectives, exclusions, reportability, and severity. This policy adds no separate trust-boundary rules, exclusions, or severity guidance.

Please report potential security vulnerabilities through OpenAI's coordinated vulnerability disclosure process. For questions about that process, contact disclosure@openai.com.

Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

When reporting a potential vulnerability, please include:

• The affected package or product and version, release artifact, or source commit.
• A clear description of the potential impact.
• Sanitized reproduction steps or a minimal proof of concept.
• Relevant runtime, environment, and known mitigations, when applicable.

Do not include live credentials, API keys, customer data, or unredacted sensitive logs.

This policy covers this repository and the official openai npm package, including its published release artifacts. Identify the affected SDK version or release; for supported Node.js versions, see NODE_VERSION_POLICY.md.

Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure.

Thank you for helping us keep this SDK and the systems it interacts with secure.