Sharing & Publication Policy

Security & Safeguards · Company practice

OpenAI may highlight your research, or act to protect users when it concerns security or misuse

In some cases OpenAI may want to highlight your research internally and/or externally. In others, such as publications about security or misuse of the API, it may want to take appropriate actions to protect its users. Both are stated as things OpenAI may want to do, not as commitments.

Supporting quotations

In some cases, we may want to highlight your work internally and/or externally.

In others, such as publications that pertain to security or misuse of the API, we may want to take appropriate actions to protect our users.

Qualifications & exceptions

• "May want to": neither highlighting nor protective action is promised.

Not stated here

• The policy does not say what "appropriate actions" are, whether they could affect your publication or your access, or whether you would be asked before your work is highlighted.

Cross-references

• qualifies (model-proposed): OpenAI welcomes research publications about the OpenAI API — qualifies: OpenAI's welcome of research publications is paired with the statement that for security or misuse publications it may want to take actions to protect users.

Security & Safeguards · Procedure

Report safety or security issues you find in research immediately through the vulnerability disclosure program

If you notice any safety or security issues with the API while doing research, OpenAI asks you to submit them immediately through its Coordinated Vulnerability Disclosure Program.

Supporting quotations

If you notice any safety or security issues with the API in the course of your research, we ask that you please submit these immediately through our [Coordinated Vulnerability Disclosure Program⁠⁠](https://openai.com/policies/coordinated-vulnerability-disclosure-policy/).

Qualifications & exceptions

• Worded as a request ("we ask that you please"), applying to issues noticed in the course of your research.

Not stated here

• The Coordinated Vulnerability Disclosure Program policy is linked but not supplied, so its terms (for example any disclosure timelines) are not analyzed here.