How OpenAI Manages Plugin Security: A Defense-in-Depth Technical Guide

OpenAI manages plugin security through a layered defense model that validates manifests at the marketplace level, enforces OWASP-compliant HTTP headers, mandates TLS 1.2+, implements OAuth PKCE with CSRF state tokens, and provides reusable security skills that automate runtime protection.

The openai/plugins repository defines a comprehensive security architecture designed to protect both the platform and end-users across third-party integrations. This system employs static manifest analysis, cryptographic authentication flows, and automated security skills to ensure every plugin meets enterprise-grade security standards before deployment.

Manifest Validation and Marketplace Controls

Every plugin must include a .codex-plugin/plugin.json manifest that explicitly declares required scopes, environment variables, and secret-handling policies. The marketplace configuration in .agents/plugins/marketplace.json automatically validates these manifests, rejecting submissions that expose hardcoded secrets or lack required security metadata.

The validation process enforces that sensitive configuration never appears in client-side code. Plugins must declare their permission boundaries upfront, allowing the marketplace to assess risk before listing. This static analysis serves as the first line of defense against credential leakage and over-privileged access.

Transport Layer Security and OWASP Headers

OpenAI mandates that all external communications use HTTPS with TLS 1.2 or higher, requiring valid certificates and automatic HTTP-to-HTTPS redirection. For plugins exposing HTTP endpoints, the repository provides specific guidance in plugins/zoom/skills/zoom-apps-sdk/concepts/security.md requiring a complete set of OWASP response headers.

The standard header configuration includes Strict-Transport-Security for HSTS enforcement, X-Content-Type-Options: nosniff to prevent MIME sniffing, Content-Security-Policy for frame ancestor control, Referrer-Policy, and X-Frame-Options. The repository includes ready-to-use Express middleware that implements these protections:

app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Content-Security-Policy',
    "frame-ancestors 'self' zoom.us *.zoom.us");
  res.setHeader('Referrer-Policy', 'same-origin');
  next();
});

Authentication Flows with PKCE and CSRF Protection

For OAuth implementations, OpenAI enforces PKCE (Proof Key for Code Exchange) in all public client flows to prevent authorization code interception attacks. Additionally, every OAuth callback must validate a cryptographically-generated state parameter to mitigate CSRF vulnerabilities, as documented in lines 59-73 and 111-123 of the Zoom security guide.

The implementation requires generating a random state value before the authorization redirect:

const crypto = require('crypto');

// Before redirect
const state = crypto.randomBytes(16).toString('hex');
req.session.oauthState = state;

// On callback
if (req.query.state !== req.session.oauthState) {
  return res.status(403).send('Invalid state');
}

PKCE verification uses a SHA-256 hashed challenge derived from a cryptographically random verifier:

const verifier = crypto.randomBytes(32).toString('hex');
const challenge = crypto.createHash('sha256')
  .update(verifier).digest('base64url');

Reusable Security Skills

OpenAI provides automated security skills that embed protection directly into plugin runtimes. These reusable components enforce security policies without requiring developers to implement complex validation logic from scratch.

The Codex Security skill (plugins/codex-security/skills/validation/SKILL.md) validates incoming data against strict schemas and automatically rejects unsafe payloads. For infrastructure protection, the Vercel Firewall skill (plugins/vercel/skills/vercel-firewall/SKILL.md) exposes APIs for configuring Web Application Firewalls, rate limiting, and bot management:

description: Vercel Firewall and security expert guidance.
endpoints:
  - method: GET
    path: /v1/security/firewall/config/active
    description: Read current firewall config
  - method: PATCH
    path: /v1/security/firewall/config
    description: Incrementally update firewall rules

The Twilio Security Hardening skill (plugins/twilio-developer-kit/skills/twilio-security-hardening/SKILL.md) codifies webhook signature verification and secure credential handling, ensuring communications APIs follow cryptographic best practices.

Secure Token Storage and Session Management

Access tokens must never reside in browser storage. Instead, OpenAI requires server-side storage solutions such as Redis, Firestore, or encrypted databases with explicit TTL handling. The security documentation in lines 92-108 of the Zoom implementation provides a Redis example:

const Redis = require('ioredis');
const redis = new Redis(process.env.REDIS_URL);

async function storeTokens(userId, tokens) {
  await redis.set(`zoom:tokens:${userId}`, 
    JSON.stringify(tokens), 
    'EX', 
    tokens.expires_in);
}

For embedded browser contexts like Zoom apps, cookies require specific hardening. The sameSite attribute must be set to 'none' with the secure flag enabled to maintain cross-origin sessions safely:

app.use(require('cookie-session')({
  name: 'session',
  keys: [process.env.SESSION_SECRET],
  maxAge: 24 * 60 * 60 * 1000,
  sameSite: 'none',
  secure: true
}));

Pre-Publication Security Checklist

Before marketplace publication, each plugin must pass an automated security checklist defined in lines 41-53 of the Zoom security file. This verification ensures:

• All OWASP headers are present and correctly configured
• TLS 1.2+ enforcement is active
• PKCE is implemented for OAuth flows
• Tokens are stored server-side with appropriate TTL
• No environment variables are hardcoded in source files

The marketplace automation runs these checks continuously, rejecting any plugin that fails validation and preventing insecure deployments from reaching users.

Summary

• Manifest validation in .agents/plugins/marketplace.json blocks plugins with exposed secrets or missing security metadata before publication.
• OWASP-compliant headers including Strict-Transport-Security and Content-Security-Policy are mandatory for all HTTP endpoints.
• OAuth implementations must use PKCE for public clients and validate cryptographically-generated state parameters to prevent CSRF attacks.
• Security skills like Codex validation, Vercel Firewall, and Twilio hardening provide automated runtime protection through reusable components.
• Server-side token storage in Redis or encrypted databases with TTL handling prevents credential exposure in browser contexts.
• Pre-publication checklists enforce that all security requirements are met before plugins become available in the marketplace.

Frequently Asked Questions

What is the minimum TLS version required for OpenAI plugins?

OpenAI requires TLS 1.2 or higher for all external communications. The security documentation explicitly mandates valid certificates and automatic redirection from HTTP to HTTPS, rejecting any plugin that transmits data over unencrypted connections.

How does OpenAI prevent OAuth authorization code interception?

OpenAI mandates PKCE (Proof Key for Code Exchange) for all public client OAuth flows. Developers must generate a cryptographically random verifier, hash it using SHA-256 to create a challenge, and verify the returned code against the original stored verifier, preventing attackers from using intercepted authorization codes.

Where must access tokens be stored in OpenAI plugins?

Access tokens must be stored server-side only, never in browser storage or client-side code. The repository recommends solutions like Redis, Firestore, or encrypted databases with explicit TTL (time-to-live) handling, as demonstrated in the token storage examples in plugins/zoom/skills/zoom-apps-sdk/concepts/security.md.

What automated security checks run during plugin publication?

The marketplace automation validates manifests against a security checklist that verifies OWASP header presence, TLS enforcement, PKCE implementation, server-side token storage, and absence of hardcoded secrets. This automated review, defined in the marketplace configuration, rejects submissions that fail any security requirement before they reach end users.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}