# Security Policy

## Security model and reportability

This is the repository's canonical security policy. The canonical detailed
threat model for Codex Security scans is
[`docs/architecture/security-model.md`](../docs/architecture/security-model.md).
Load that document from the exact scanned revision when deciding scan scope,
trust boundaries, attacker capabilities, security objectives, exclusions,
reportability, and severity. This policy adds no separate trust-boundary rules,
exclusions, or severity guidance.

For CI runner trust and isolation assumptions, see
[CI runner configuration](../docs/architecture/security-model.md#ci-runner-configuration).

## Reporting a vulnerability

Please report potential security vulnerabilities through OpenAI's
[coordinated vulnerability disclosure process](https://openai.com/policies/coordinated-vulnerability-disclosure-policy).
For questions about that process, contact disclosure@openai.com.

Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

## What to include

When reporting a potential vulnerability, please include:

- The affected package or product and version, release artifact, or source
  commit.
- A clear description of the potential impact.
- Sanitized reproduction steps or a minimal proof of concept.
- Relevant runtime, environment, and known mitigations, when applicable.

Do not include live credentials, API keys, customer data, or unredacted sensitive logs.

This policy covers this repository and the official
[`openai` npm package](https://www.npmjs.com/package/openai), including its
published release artifacts. Identify the affected SDK version or release; for
supported Node.js versions, see
[`NODE_VERSION_POLICY.md`](../NODE_VERSION_POLICY.md).

## Coordinated disclosure

Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure.

Thank you for helping us keep this SDK and the systems it interacts with secure.