OpenAI SDK for Ruby 0.85.0

Apply these rules when using the official openai gem 0.85.0 from a server-side Ruby application. This release supports CRuby 3.3, 3.4, and 4.0 and requires Ruby >= 3.3.0. Apply the Ruby 4.0 baseline first.

Treat prompts, retrieved content, model output, tool calls, stream events, webhook bodies, files, resource identifiers, and provider responses as untrusted data. SDK types and parsed objects do not establish validation, ownership, or authorization.

Version, credentials, and client scope

• Lock the official openai gem in Gemfile.lock and review SDK and optional Realtime/provider dependency changes before deployment. The SDK ships a security fix as a patch release, and its security policy doesn't guarantee fixes or backports for older release lines, so taking a fix can mean moving to the newest minor, which may carry breaking changes while the gem is still 0.x. Add the gem with bundle add openai --optimistic so the Gemfile admits newer minors: without that flag, Bundler 4.0 and earlier write a ~> requirement that keeps a 0.x gem on one minor. Where an existing requirement already does that, raise it when a fix ships in a newer minor.
• Create OpenAI::Client only in trusted server code. Never ship API keys, admin keys, webhook secrets, AWS credentials, bearer tokens, or client private keys to browsers, mobile clients, prompts, tool results, URLs, source control, or generated artifacts.
• Load credentials with ENV.fetch or an approved secret manager, grant the key only the required project and role, separate production from development projects, set