Openai sdk security scan

OpenAI SDK Security Scan

Defensive scan for applications using the OpenAI SDK. Reports findings using the shared scoring schema.

Scope

• Files importing openai (Python) or openai (Node)
• Calls to chat.completions.create, responses.create, beta.assistants.*, beta.threads.*
• Function/tool definitions and dispatch handlers

Rules

ID	Severity	Detection	Fix
OAI-KEY-001	critical	new OpenAI({ apiKey: ... }) reads NEXT_PUBLIC_* / VITE_* / runs in client-side bundle	Move calls behind a server route; never ship the key
OAI-KEY-002	high	Hardcoded sk-... key literal in source	Move to env; rotate immediately
OAI-INJ-001	high	User-controlled document content in a user message without delimiter / data-vs-instruction framing	Wrap in tagged block (<doc>...</doc>) and instruct the model to treat as data
OAI-INJ-002	high	Tool/function result returned to the model unsanitized while agent has high-privilege tools	Treat tool results as untrusted; require confirmation for irreversible actions
OAI-FN-001	critical	Function-call handler executes shell / SQL / fs from tool_calls[i].function.arguments without parsing+validating against the declared parameters schema	Parse with JSON.parse then validate with zod/Pydantic against the same schema you advertised
OAI-FN-002	high	Function declared with additionalProperties: true (or omitted) on input schema	Set additionalProperties: false; enumerate required fields
OAI-FN-003	medium	Multiple high-impact tools registered without tool_choice constraints in agent loops	Constrain tool_choice per step; consider explicit per-step planner
OAI-OUT-001	critical	Model output passed to eval / exec / Function() / subprocess.run(shell=True) / direct SQL	Parse into a structured schema and dispatch via allowlisted code paths
OAI-OUT-002	high	Model output rendered with dangerouslySetInnerHTML / v-html / innerHTML	Render as text or sanitize
OAI-STRUCT-001	medium	Code parses model output expecting JSON without using response_format: { type: "json_schema", strict: true } (or response_format: { type: "json_object" })	Use Structured Outputs with strict schema; validate the result anyway
OAI-VISION-001	high	Image URL in image_url content block fetched from user-supplied URL with no allowlist	Allowlist hosts; or download server-side, validate MIME/size, re-upload
OAI-ASST-001	high	Assistants API thread shared across users (single thread id reused for many tenants)	One thread per user/session; never cross-tenant
OAI-ASST-002	high	File uploaded via files.create from user input without size/MIME/AV check	Validate before upload; tag with tenant id
OAI-MOD-001	medium	Output rendered in a public-facing UI without consulting moderations / safety classifier	Run user input through moderation for safety-critical surfaces; log decisions
OAI-LOG-001	medium	Full messages / input / output logged at info level in production	Log request id and token counts; redact bodies
OAI-RETRY-001	low	Custom retry loop without backoff on 429/5xx (DoS amplification)	Use SDK built-in retry or exponential backoff

Wrong vs. right

OAI-FN-001 (unvalidated function args)

# ❌ Direct execution
args = json.loads(tool_call.function.arguments)
subprocess.run(args["command"], shell=True)

# ✅ Schema-validated + allowlisted
from pydantic import BaseModel
from typing import Literal

class RunArgs(BaseModel):
    command: Literal["build", "test", "lint"]

args = RunArgs.model_validate_json(tool_call.function.arguments)
spawn_allowlisted(args.command)

OAI-STRUCT-001 (no structured output)

// ❌ Hope the model returns JSON
const completion = await client.chat.completions.create({
  model: "gpt-4.1",
  messages: [...],
});
const data = JSON.parse(completion.choices[0].message.content!);

// ✅ Strict schema enforcement
const completion = await client.chat.completions.create({
  model: "gpt-4.1",
  messages: [...],
  response_format: {
    type: "json_schema",
    json_schema: {
      name: "extract",
      strict: true,
      schema: {
        type: "object",
        additionalProperties: false,
        required: ["email", "score"],
        properties: {
          email: { type: "string", format: "email" },
          score: { type: "integer", minimum: 0, maximum: 100 },
        },
      },
    },
  },
});

OAI-ASST-001 (cross-tenant thread)

// ❌ Single shared thread
const thread = await client.beta.threads.create();  // module-level
// later: every user posts to thread.id

// ✅ One thread per session
const threadId = await getOrCreateThreadForUser(userId);

References

• OpenAI SDK (Node): https://github.com/openai/openai-node
• OpenAI SDK (Python): https://github.com/openai/openai-python
• Structured Outputs: https://platform.openai.com/docs/guides/structured-outputs
• Function calling: https://platform.openai.com/docs/guides/function-calling
• OWASP LLM Top 10: https://owasp.org/www-project-top-10-for-large-language-model-applications/