docs: standardize Python SDK vulnerability disclosure policy

[HAYDEN-OAI]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

• Standardize SECURITY.md on the shared public SDK policy: Reporting a vulnerability, What to include, and Coordinated disclosure.
• Use the exact shared warnings against public GitHub issues/pull requests/discussions and including live credentials, API keys, customer data, or unredacted sensitive logs.
• Preserve Python's existing coordinated-disclosure URL, disclosure@openai.com contact, authentication-header/private-key redaction, and respectful disclosure commitment.
• Document the official openai PyPI package, published source distributions/wheels, and relevant package version, Python version, operating system, impact, and sanitized reproduction details.

Verification

• CommonMark parsing and exact assertions for the three canonical headings, three shared report-detail bullets, and all three verbatim shared warning/disclosure sentences.
• Existing disclosure endpoint returned HTTP 200; disclosure URL/contact were preserved, and the PyPI URL matches the existing README and actual sdist/wheel build targets.
• Credential-like-literal, line-ending, trailing-whitespace, and Markdown-link validation.
• python scripts/check-python-version-policy.py
• git diff origin/main...HEAD --check

Additional context & links

Only the existing root SECURITY.md is changed; no private-reporting settings, workflows, package code, or unrelated policies are modified.

[openai-sdks]

OkTest Summary

❌ Failed for Python SDK PR #3642.

View OkTest run #32279852100

_{SDK merge (d82bb5ad1268) · head (4e18249db2c6) · base (753ab5c1a81c) · OkTest (0ad95c429af9)}

[jbeckwith-oai]

Overview: The private reporting route, package/artifact scope, and redaction guidance are sound. Two small consistency gaps remain in the standardized policy.

[Low] Accept a source commit when no release version exists

Location: SECURITY.md:17-22

openai-python/SECURITY.md

Lines 17 to 22 in e2af4b7

	- The affected package or product and version.
	- A clear description of the security impact.
	- Sanitized steps to reproduce the issue.
	For the `openai` Python package, include the Python version, operating system,
	and affected source distribution or wheel when relevant.

The document newly covers repository source, but the report checklist only requests a package/product version and distribution format. A finding against unreleased main or another development branch may have no applicable release version, and the moving branch is not a stable reproduction target. Please change the first bullet to request the affected package/product and version, or the relevant source commit.

[Low] Match the linked confidentiality rule

Location: SECURITY.md:29-31

openai-python/SECURITY.md

Lines 29 to 31 in e2af4b7

	## Coordinated disclosure
	Please give the maintainers a reasonable opportunity to investigate and address the issue before public disclosure.

The linked OpenAI process routes researchers to Bugcrowd, whose current engagement brief requires vulnerability details to remain confidential until OpenAI authorizes release. Asking only for a reasonable opportunity before public disclosure can be read as permitting unilateral release after a subjective waiting period. Please defer explicitly to the linked coordinated-disclosure terms and state that details remain confidential until release is coordinated or authorized. Keep this as a short cross-reference rather than copying a separate repository-specific timeline.

No additional actionable findings. Exact-head CI is green.

[jbeckwith-oai]

Independent two-pass re-review confirms both prior reporting-policy concerns are fixed: unreleased source commits can identify affected versions, and vulnerability disclosure requires coordinated release or authorization. Package and distribution scope, conditional environment details, private reporting, and credential safeguards match existing policy; substantive CI passes.