search

openai / openai-python

The official Python library for the OpenAI API
https://pypi.org/project/openai/
Apache License 2.0
21.09k stars 2.86k forks source link

Please add a security policy on how to report security issues #1278

Open ericwb opened 3 months ago

ericwb commented 3 months ago

Confirm this is a feature request for the Python library and not the underlying OpenAI API.

Describe the feature or improvement you're requesting

Please add a security policy to this GitHub repo. I can't find any information on how to report security issues in private. Using the issue tracker would be undesirable as it could zero-day some exploits reported.

Additional context

For example, these issues really should have been reported privately:

ericwb commented 3 months ago

Maybe at least consider pointing to https://openai.com/policies/coordinated-vulnerability-disclosure-policy

rattrayalex commented 3 months ago

Hey thanks, this is a good call-out. We'll discuss internally. For now that link should work. For SDK-specific vulns, you can also email security@stainlessapi.com.

rattrayalex commented 3 months ago

What are some places you would expect to find this in a library like this? CONTRIBUTING.md?

ericwb commented 3 months ago

What are some places you would expect to find this in a library like this? CONTRIBUTING.md?

Typically there is a security.md policy file you define as part of the repo. GitHub has some instructions here on how to set that up: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository.

Once setup, it'll show up here: https://github.com/openai/openai-python/security. But it would also be benefit to change the issues template to point folks to the security policy to report any vulnerabilities.

rattrayalex commented 3 months ago

Ah, terrific – we'll get that set up next week! Thank you so much @ericwb !