# openai-python: CLEAN

CWE-407 scan: 2026-03-30

Source: https://github.com/openai/openai-python (depth=1)

## Scan scope

- `src/openai/` — 1073 Python files
- Focus: API client model list membership, retry logic dedup, streaming chunk dedup, tool call assembly membership, batch request dedup, file upload dedup
- Keywords: `in list`, `.index(`, `if x in`, nested for loops

## Findings

No CWE-407 defects found.

- Streaming delta accumulator (`lib/streaming/_deltas.py`) uses dict-based `acc` — O(1) lookup
- Tool call done tracking (`lib/streaming/chat/_completions.py:593`) uses `set[int]` — correct
- `get_input_tool_by_name` is O(T) linear scan per call but not nested in a loop; bounded by tool count (typically < 10)
- `_base_client.py:451` creates `lower_custom_headers` list but only does 2 constant `in` checks — not O(N^2)
- `_validators.py` has O(A^2) in `additional_column_validator` but A is bounded by DataFrame columns (typically < 10)
- All dedup and membership patterns use dict/set/frozenset throughout

## Verdict

CLEAN — well-engineered SDK with proper data structure choices throughout.