auditnone

urn:signet:att:sha256:fbe218d2404ed5847249b6d1111475844099e366030059bd30c96952029c40a5

signed by sha256:0e2f8c7616079f540a68f… (tier 0) · registered 2026-07-22T02:38:14.301796Z

Subjects

  • https://github.com/openai/openai-node @ bf19e8a70e3d4c5b6a1f2039485766778899aabb

Claims

vetted-cleanCWE-79, CWE-918SDK request builder reviewed; scanner findings triaged below

Scope

  • src/core.ts ffffffffffffffff…
  • src/index.ts eeeeeeeeeeeeeeee…

False positives (3)

Scanner findings this auditor reviewed and dismissed, with signed justification — consumers can suppress by ruleId + file hash.

  • false-positiveintentional-by-designflagged by semgrep@1.79.0

    typescript.react.security.audit.react-http-leak

    src/core.ts :212-218 ffffffffffffffff…

    The base URL is the caller-configured API host, not attacker input; SSRF requires an untrusted URL and there is none on this path.

    evidence: src/core.ts#L188

  • false-positiveconstant-inputflagged by semgrep@1.79.0

    javascript.lang.security.audit.unsafe-formatstring

    src/index.ts :47-47 eeeeeeeeeeeeeeee…

    The format argument is a compile-time string literal; no user data reaches the template.

  • false-positivesanitized-elsewhereflagged by semgrep@1.79.0

    typescript.lang.security.audit.prototype-pollution

    src/core.ts :340-352 ffffffffffffffff…

    Header keys are validated against an allowlist in normalizeHeaders() before this merge, so __proto__ cannot reach the assignment.

    evidence: src/core.ts#L301

Methodology

semgrep@1.79.0

Verifications (0)

none yet

Raw statement (decoded payload)
{
  "_type": "https://in-toto.io/Statement/v1",
  "predicate": {
    "auditor": {
      "type": "human"
    },
    "claims": [
      {
        "notes": "SDK request builder reviewed; scanner findings triaged below",
        "status": "vetted-clean",
        "vulnClasses": [
          "CWE-79",
          "CWE-918"
        ]
      }
    ],
    "expiresAt": null,
    "falsePositives": [
      {
        "category": "intentional-by-design",
        "evidenceRefs": [
          "src/core.ts#L188"
        ],
        "flaggedBy": {
          "ruleId": "typescript.react.security.audit.react-http-leak",
          "tool": "semgrep",
          "version": "1.79.0"
        },
        "justification": "The base URL is the caller-configured API host, not attacker input; SSRF requires an untrusted URL and there is none on this path.",
        "location": {
          "file": "src/core.ts",
          "lines": [
            {
              "end": 218,
              "start": 212
            }
          ],
          "sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
        },
        "verdict": "false-positive"
      },
      {
        "category": "constant-input",
        "evidenceRefs": [],
        "flaggedBy": {
          "ruleId": "javascript.lang.security.audit.unsafe-formatstring",
          "tool": "semgrep",
          "version": "1.79.0"
        },
        "justification": "The format argument is a compile-time string literal; no user data reaches the template.",
        "location": {
          "file": "src/index.ts",
          "lines": [
            {
              "end": 47,
              "start": 47
            }
          ],
          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
        },
        "verdict": "false-positive"
      },
      {
        "category": "sanitized-elsewhere",
        "evidenceRefs": [
          "src/core.ts#L301"
        ],
        "flaggedBy": {
          "ruleId": "typescript.lang.security.audit.prototype-pollution",
          "tool": "semgrep",
          "version": "1.79.0"
        },
        "justification": "Header keys are validated against an allowlist in normalizeHeaders() before this merge, so __proto__ cannot reach the assignment.",
        "location": {
          "file": "src/core.ts",
          "lines": [
            {
              "end": 352,
              "start": 340
            }
          ],
          "sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
        },
        "verdict": "false-positive"
      }
    ],
    "methodology": {
      "tools": [
        {
          "config": {
            "ruleset": "p/owasp-top-ten"
          },
          "name": "semgrep",
          "version": "1.79.0"
        }
      ]
    },
    "schemaVersion": "1.0.0",
    "scope": {
      "paths": [
        {
          "file": "src/core.ts",
          "sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
        },
        {
          "file": "src/index.ts",
          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
        }
      ],
      "type": "files"
    },
    "timestamp": "2026-07-19T16:00:00Z"
  },
  "predicateType": "https://signet.dev/attestation/audit/v1",
  "subject": [
    {
      "digest": {
        "gitCommit": "bf19e8a70e3d4c5b6a1f2039485766778899aabb"
      },
      "name": "https://github.com/openai/openai-node"
    }
  ]
}