openai/openai-node

Pin third-party GitHub Actions to full, immutable commit SHAs. Publish npm packages only through protected GitHub Actions OIDC trusted publishing; never add token-based release paths. Expose GitHub App private keys, OIDC credentials, and permissions only to trusted release jobs; never expose them to unreviewed scripts or untrusted code.

When validation and dispatch must agree, snapshot only the security-critical values or serialized representation, within bounded memory, before irreversible network or request-body side effects. Preserve request-options object identity and protected-hook mutations; never validate one mutable representation and serialize another.

Treat provider endpoints, headers, filenames, schemas, and object properties as untrusted. At JSON object-record boundaries, validate the own properties and values actually emitted, accounting for serialization hooks and omitted values; reject or safely preserve dangerous prototype keys. Preserve supported inherited protocols and validate the final request, including normalized host/origin, redirects, protected hooks, custom fetch transports, and both current and legacy entrypoints. Never leak bearer tokens, API keys, certificates, request bodies, or other credentials across trust boundaries.

Never place secret API keys in browser bundles or enable dangerouslyAllowBrowser without explicit security review. Always redact credentials, authorization headers, cookies, and webhook secrets. Keep real customer-sensitive request or response data out of default or uncontrolled logs, errors, test output, snapshots, and CI artifacts. Preserve documented opt-in OPENAI_LOG=debug or logLevel: 'debug' logging and APIError.error diagnostics with clear sensitive-data warnings; redact them before forwarding to untrusted sinks.

Never commit API keys, tokens, private keys, .env files, customer data, or other secrets. Read OPENAI_API_KEY from the environment and keep examples, fixtures, recordings, and snapshots synthetic.

Azure transcription sessions also use transcription intent. Do not pass a deployment in the connection options; configure the transcription deployment in a session.update event after the socket opens:

Register error and abort listeners before handing the stream to another consumer. If you call a promise-returning helper such as .done() or .finalRun(), await or catch that promise as well; event listeners do not handle a separate promise rejection.

Keep workflow tokens, permissions, and secrets at the narrowest required scope. Bind privileged checkout, release, and publication operations to the validated, immutable commit; do not trust floating refs, mutable tags, optional checks, or assumptions about repository settings and app permissions.

Treat large payloads as a normal API contract, not evidence of malformed or hostile input. Responses, Chat Completions, and other APIs can legitimately return large application/json bodies, streaming events, and WebSocket messages. Do not introduce arbitrary fixed limits on bodies, frames, events, or lines as a security or efficiency fix. Prefer incremental processing, amortized-linear buffering, timely cleanup, and caller cancellation. Any new rejection limit needs an explicit, owner-approved API contract and a review of existing supported payloads and transports. Protect this behavior with d

Preserve meaningful 0, false, and empty-string values, and distinguish explicit null from an omitted or undefined value where the contract does. Do not replace presence or nullish checks with truthiness checks.

Follow the custom-code guidance. Budget changes belong in a separate PR containing only .castiron-ratchet.json, with an explicit justification in the PR description. Increases require a human approving review before merging. Agents may investigate and draft proposals, but must not approve budget increases (including through a human's credentials) or bypass the gate. Do not weaken counting, broaden exclusions, or alter generation metadata to make a change pass. The checker and effective budget come from main, not the PR. Keep default CODEOWNERS.

Keep optional integrations isolated from the core SDK. Do not make a provider's optional dependency, environment, credential, or runtime requirement mandatory for unrelated clients; test both installed and absent optional dependencies when the import boundary changes.

For externally observable bug or behavior fixes, reproduce the reported issue against the current repository and public SDK entrypoint before proposing a fix. Check existing issues and pull requests; inspect the API schema and generated/upstream ownership only when relevant. Do not duplicate existing work, "fix" intended API behavior, or patch a generated symptom that belongs in the schema or generator.

Keep handwritten production and test files cohesive. Extract a well-defined owner only when the current change materially grows a file and reveals a coherent, distinct responsibility. Keep unrelated cleanup separate, and do not inflate fixtures or suites to justify an overly complicated implementation.