OpenAI SDK for Python 3.6

Last reviewed Sep 12, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Python 3155 lines · 3.8K tokens
  2. OpenAI SDK for Python 3.656 lines · 1.4K tokens
Total211 lines · 5.1K tokens

CWE Coverage

  • 20
  • 23
  • 36
  • 59
  • 78
  • 89
  • 95
  • 117
  • 208
  • 209
  • 214
  • 250
  • 295
  • 306
  • 319
  • 328
  • 338
  • 347
  • 367
  • 379
  • 409
  • 416
  • 426
  • 427
  • 470
  • 502
  • 522
  • 532
  • 611
  • 639
  • 674
  • 732
  • 770
  • 772
  • 776
  • 799
  • 807
  • 829
  • 862
  • 916
  • 918
  • 1104
  • 1333
  • 1395
  • 1426
  • 1427

Prompt Preview

Apply the Python 3 baseline first. These rules cover OpenAI SDK for Python 3.6 client security, Responses API inputs, structured output, tool calls, streaming, files, webhooks, retries, and production operations.

Client and credentials

  • Construct OpenAI clients with server-side project keys or approved workload credentials and never expose secret keys to untrusted clients.
  • Keep base_url, organization, project, proxy, custom transport, and default headers in trusted configuration.
  • Keep extra_headers, extra_query, extra_body, and low-level request URLs in trusted code; these options can override vetted request settings or the configured destination.
  • Treat the process TLS environment as privileged configuration: OpenAI Python 3.6 uses HTTPX2 with the operating-system trust store and trust_env=True by default, so protect SSL_CERT_FILE and SSL_CERT_DIR or pass an explicit ssl.SSLContext through DefaultHttpx2Client(verify=...).
  • For API-key mTLS, dedicate the certificate-bearing HTTP client to the approved API origin and set follow_redirects=False; rebuild the TLS context and clients when rotating certificates.
  • Separate projects, keys, service accounts, quotas, and data boundaries across environments and mutually untrusted tenants.
  • Override the SDK's 10-minute request timeout and two automatic retries with workload-specific timeout and max_retries; a timeout is itself retried and does not prove the remote operation failed.
  • Close custom synchronous and asynchronous clients and HTTP transports deterministically.

Responses and