# Security review

The trust boundary begins at application-owned configuration and request data
and ends at the configured HTTPS Responses endpoint. This trusted native module
does not claim to sandbox network activity.

| Risk | Control and evidence |
|---|---|
| Ambient credential capture | Only explicit `Config.APIKey` is accepted; the adapter does not use SDK environment defaults. |
| Credential or content disclosure | Secret tags, redacted `Config.String`, typed bounded errors, safe causes, metadata allowlist, and adversarial leak tests. |
| Endpoint credential exfiltration | Base URL must be absolute HTTPS with a host and no URL user information. |
| Hidden provider data retention | Every request sets `store=false`; the provider exposes no raw SDK accessor. |
| Duplicate side effects | A hashed operation idempotency key protects startup attempts; no provider retry occurs after a stream is returned. |
| Partial tool execution | Only finalized function calls in `response.completed` become Spice calls; malformed, duplicate, undeclared, and hosted calls fail closed. |
| Unbounded output | Core 4 MiB operation-text and 128 tool-call caps plus provider input/output-item bounds and 64 KiB translated chunks. |
| Unbounded wait or goroutine accumulation | Caller operation context, two-minute default and thirty-minute maximum configured timeout, one bounded stream pump, per-`Recv` context selection, and joined cooperative close. |
| Protocol/transport leakage | Startup and receive errors are typed separately; public text is generic, safe metadata is allowlisted, and raw upstream failures are not exposed. |
| Global cross-tenant state | One client/service/HTTP transport per injected provider bean; no registry or package-level mutable client. |
| Accidental live traffic | Unit/integration tests use scripted sources or fake TLS HTTP. Live acceptance is excluded without the `openai_live` build tag and also requires an exact environment opt-in, credentials, and explicit model. Ordinary gates remain offline. |
| Live acceptance secret leakage | The live test never prints configuration or upstream error details, configuration errors are value-free, and unit tests prove unconditional error redaction. |
| Unbounded live acceptance cost or output | One short request, no tools, `store=false`, zero SDK retries, a 90-second timeout, an explicit model, 128 observed events, and 4 KiB accumulated text. |

Residual trust is explicit: application code supplies the HTTP client and
endpoint policy, and the OpenAI SDK performs the HTTPS exchange. A custom
transport can observe requests and credentials and must be treated as trusted
application code. A transport that ignores context cancellation and close can
prevent cooperative shutdown; the provider does not claim forcible containment.
Provider metadata is discarded by the engine unless the application explicitly
allowlists `openaiprovider.MetadataNamespace`.