Security
Secrets, execution and injection sinks
← Back to code signals AUTOMATED CODE SIGNAL v1
openai / openai-agents-js
openai-agents-js.
6 rule matches across 80 source files. This is a static snapshot—not a review of runtime behavior or a security certification.
AUTOMATED CODE SIGNAL
62/100
WARNINGNot a GAAAS certification · scanned October 4, 2026
80 source files checked6 findingsPARTIAL scan scopeStatic audit · manual review recommended
01 / SCORE BREAKDOWN
Where it stands.
Each pillar is worth 25 points. Deductions follow matched rules and are capped per pillar.
25/25
Cost guardrails
Loops, token limits and rate controls
Schema quality
Runtime validation of model output
Transparency
System context and sensitive logging
02 / SOURCE EVIDENCE
What the scan found.
Locations point to the public repository. Source snippets are omitted to avoid republishing exposed credentials.
MINORTRANSPARENCY
Sensitive context logged
Prompts or model context may be written to application logs.
FIXLog metadata and stable identifiers only; redact secrets and user content.
MINORTRANSPARENCY
Sensitive context logged
Prompts or model context may be written to application logs.
FIXLog metadata and stable identifiers only; redact secrets and user content.
CRITICALCOST GUARDRAILS
Critical finding under coordinated disclosure
Technical details are embargoed until 2026-11-03 to allow remediation.
FIXThe maintainer has been given a remediation window before edited details are published.
MAJORCOST GUARDRAILS
Missing token limit
LLM request does not declare an output-token ceiling.
FIXSet max_tokens, maxOutputTokens, or the provider-equivalent limit on every request.
MAJORSCHEMA QUALITY
Missing structured-output schema
LLM output is consumed without an explicit runtime schema.
FIXDefine a Zod, JSON Schema, Pydantic, or provider-native structured-output schema.
MINORSCHEMA QUALITY
Raw model text returned
Raw model-generated text is returned to a caller without validation.
FIXParse and validate model output into a typed object before returning it.
03 / SHARE THE SIGNAL
Show the signal—accurately.
This badge identifies an automated code signal. Only a current signed certificate may use the GAAAS Verified mark.
[](https://gaaas.thanhdan.dev/agents/openai/openai-agents-js)