← Legacy view v2 (rp.*)

openai/openai-node

https://github.com/openai/openai-node · lang: typescript · LOC: · source: user_submitted

Quality
85.5
Grade A-
Security
96.0
Findings
73
2 critical · 17 high
Status
completed
May 24, 2026 01:20
low: 30 info: 21 high: 17 medium: 3 critical: 2
Top rules by occurrence
RuleSeverityCount
AIC003 Duplicated implementation block across source files low 30
MINED044 Js Console Log Prod info 4
MINED045 Ts Non Null Assertion info 4
MINED052 Ts Any Typed info 4
MINED054 Ts As Any info 4
SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from use… high 4
SEC128 Async function without await — fire-and-forget Promise (AI … high 3
SEC085 JS: child_process.exec with non-literal high 2
SEC045 eval()/exec() on stored or user-supplied data medium 2
SEC135 Auth/permission check missing on AI-generated endpoint high 2
First 73 findings (severity-sorted)
critical MINED116 GHA pull_request workflow leaks secrets to forks CWE-829
.github/workflows/ci.yml:114 · conf 0.90 
[MINED116] Workflow uses `secrets.OPENAI_API_KEY` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.OPENAI_API_KEY }` le…
critical MINED116 GHA pull_request workflow leaks secrets to forks CWE-829
.github/workflows/ci.yml:149 · conf 0.90 
[MINED116] Workflow uses `secrets.OPENAI_API_KEY` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.OPENAI_API_KEY }` le…
high MINED004 Weak Crypto CWE-327
src/resources/uploads/uploads.ts:198 · conf 1.00 
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).
high MINED113 Express POST/PUT/DELETE/PATCH route without auth CWE-306CWE-862
examples/stream-to-client-express.ts:29 · conf 0.80 
[MINED113] Express POST / has no auth: Express route POST / declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A…
high MINED113 Express POST/PUT/DELETE/PATCH route without auth CWE-306CWE-862
examples/stream-to-client-raw.ts:31 · conf 0.80 
[MINED113] Express POST / has no auth: Express route POST / declared without an auth middleware in its handler chain. Destructive methods (POST/PUT/DELETE/PATCH) on unauthenticated routes are OWASP A…
high MINED122 package.json dep pulled from git URL or tarball CWE-829
examples/package.json:1 · conf 0.90 
[MINED122] package.json dep `openai` pulled from URL/Git: `dependencies.openai` = `file:..` bypasses the npm registry. No integrity hash, no version locking, no registry-side scanning. If the URL or …
high MINED122 package.json dep pulled from git URL or tarball CWE-829
package.json:1 · conf 0.90 
[MINED122] package.json dep `tsc-multi` pulled from URL/Git: `devDependencies.tsc-multi` = `https://github.com/stainless-api/tsc-multi/releases/download/v1.1.11/tsc-multi.tgz` bypasses the npm regist…
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
ecosystem-tests/cloudflare-worker/src/worker.ts:36 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
src/auth/subject-token-providers.ts:81 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
src/beta/realtime/internal-base.ts:81 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
high SEC040 innerHTML XSS — template literal with server-supplied data
src/internal/to-file.ts:153 · conf 1.00 
[SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflect…
high SEC083 JS: new RegExp() with non-literal
src/_vendor/zod-to-json-schema/parsers/string.ts:389 · conf 1.00 
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).
high SEC085 JS: child_process.exec with non-literal
src/internal/detect-platform.ts:143 · conf 1.00 
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).
high SEC085 JS: child_process.exec with non-literal
src/internal/utils/path.ts:56 · conf 1.00 
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).
high SEC128 Async function without await — fire-and-forget Promise (AI mistake)
src/internal/headers.ts:79 · conf 1.00 
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…
high SEC128 Async function without await — fire-and-forget Promise (AI mistake)
src/internal/ws-adapter-browser.ts:65 · conf 1.00 
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…
high SEC128 Async function without await — fire-and-forget Promise (AI mistake)
src/internal/ws-adapter-node.ts:45 · conf 1.00 
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…
high SEC135 Auth/permission check missing on AI-generated endpoint
examples/stream-to-client-express.ts:29 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
high SEC135 Auth/permission check missing on AI-generated endpoint
examples/stream-to-client-raw.ts:31 · conf 1.00 
[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we…
medium ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors.
src/_vendor/partial-json-parser/parser.ts:209 · conf 1.00 
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
medium SEC045 eval()/exec() on stored or user-supplied data
src/internal/detect-platform.ts:143 · conf 1.00 
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …
medium SEC045 eval()/exec() on stored or user-supplied data
src/internal/utils/path.ts:56 · conf 1.00 
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …
low AIC003 Duplicated implementation block across source files
ecosystem-tests/cloudflare-worker/src/uploadWebApiTestCases.ts:20 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/deno/main_test.ts:29 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/deno/main_test.ts:39 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/ts-browser-webpack/src/index.ts:13 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/ts-browser-webpack/src/index.ts:89 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/ts-browser-webpack/src/test.ts:1 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/vercel-edge/src/pages/api/edge-test.ts:12 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/vercel-edge/src/pages/api/node-test.ts:5 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/vercel-edge/src/pages/api/node-test.ts:6 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/vercel-edge/src/uploadWebApiTestCases.ts:45 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
ecosystem-tests/vercel-edge/src/uploadWebApiTestCases.ts:56 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/beta/realtime/ws.ts:40 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/internal/stream-utils.ts:1 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/internal/ws-adapter-node.ts:11 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/lib/ChatCompletionStream.ts:447 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/lib/EventEmitter.ts:1 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/lib/EventStream.ts:43 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/lib/parser.ts:105 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/lib/responses/ResponseStream.ts:246 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/realtime/internal-base.ts:14 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/realtime/websocket.ts:6 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/realtime/ws.ts:4 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/realtime/ws.ts:39 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/organization.ts:234 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/projects/certificates.ts:69 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/projects/groups/groups.ts:2 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/projects/groups/index.ts:10 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/projects/groups/roles.ts:46 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/resources/admin/organization/projects/users/index.ts:1 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/_vendor/zod-to-json-schema/parsers/number.ts:24 · conf 0.86 
Duplicated implementation block across source files
info MINED043 Http Not Https CWE-319
src/auth/subject-token-providers.ts:146 · conf 1.00 
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
info MINED044 Js Console Log Prod CWE-532
· conf 0.20 
[MINED044] Js Console Log Prod (and 51 more): Same pattern found in 51 additional files. Review if needed.
info MINED044 Js Console Log Prod CWE-532
ecosystem-tests/browser-direct-import/public/index.js:25 · conf 1.00 
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.
info MINED044 Js Console Log Prod CWE-532
ecosystem-tests/browser-direct-import/src/test.ts:15 · conf 1.00 
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.
info MINED044 Js Console Log Prod CWE-532
ecosystem-tests/cloudflare-worker/src/worker.ts:42 · conf 1.00 
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.
info MINED045 Ts Non Null Assertion CWE-476
· conf 0.20 
[MINED045] Ts Non Null Assertion (and 10 more): Same pattern found in 10 additional files. Review if needed.
info MINED045 Ts Non Null Assertion CWE-476
ecosystem-tests/proxy.ts:22 · conf 1.00 
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.
info MINED045 Ts Non Null Assertion CWE-476
examples/azure/chat.ts:25 · conf 1.00 
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.
info MINED045 Ts Non Null Assertion CWE-476
examples/function-call-diy.ts:84 · conf 1.00 
[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong.
info MINED052 Ts Any Typed CWE-704
· conf 0.20 
[MINED052] Ts Any Typed (and 25 more): Same pattern found in 25 additional files. Review if needed.
info MINED052 Ts Any Typed CWE-704
ecosystem-tests/cloudflare-worker/src/worker.ts:54 · conf 1.00 
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
info MINED052 Ts Any Typed CWE-704
ecosystem-tests/ts-browser-webpack/src/index.ts:63 · conf 1.00 
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
info MINED052 Ts Any Typed CWE-704
ecosystem-tests/vercel-edge/src/pages/api/edge-test.ts:22 · conf 1.00 
[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.
info MINED053 Placeholder Default Username CWE-1392CWE-798
src/resources/index.ts:5 · conf 1.00 
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.
info MINED054 Ts As Any CWE-704
· conf 0.20 
[MINED054] Ts As Any (and 33 more): Same pattern found in 33 additional files. Review if needed.
info MINED054 Ts As Any CWE-704
ecosystem-tests/cloudflare-worker/src/worker.ts:76 · conf 1.00 
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
info MINED054 Ts As Any CWE-704
ecosystem-tests/vercel-edge/src/pages/api/edge-test.ts:50 · conf 1.00 
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
info MINED054 Ts As Any CWE-704
ecosystem-tests/vercel-edge/src/pages/api/node-test.ts:40 · conf 1.00 
[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely.
info SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
· conf 0.20 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 7 more): Same pattern found in 7 additional files. Review if needed.
info SEC084 JS: require() with non-literal
scripts/utils/make-dist-package-json.cjs:1 · conf 0.10 
[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules — equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0).
info SEC118 UUIDv1 / UUIDv3 used for security-sensitive identifier
src/internal/utils/uuid.ts:9 · conf 0.10 
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/e4d4c80f-102b-4c6f-b2fd-1a5fa991e3a4/.