OpenAI Security Bots
https://github.com/openai/openai-security-bots- Category
- Cybersecurity
- Rank
- No. 1384Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- openai
- GitHub
- 397 stars
- Date
About
OpenAI's collection of security automation bots: triage, analysis, and response workflows powered by LLMs.
What it does
These are self-hosted Slack applications for two concrete security jobs shown in code. One classifies incoming requests, posts feed updates, routes work to an on-call destination, and supports manual recategorization. Another collects project details, reads linked Slack threads or Google Docs, asks an OpenAI model for a risk decision or follow-up questions, and stores assessments in PostgreSQL.
Why it's ranked here
The repository offers useful reference implementations, especially for teams whose security intake already lives in Slack. Human correction, configurable routing, follow-up questions, and persisted assessments make the workflows more substantial than simple chat wrappers. However, deployment requires several external services and the SDLC bot contains brittle response parsing and a fixed model name, so adoption needs engineering work.
What's good
The triage flow keeps people in control: staff can acknowledge requests, change predicted categories, select another conversation, or configure automatic replies. Routing can target a channel or an individual on call. The SDLC flow validates required fields, detects duplicate project names, gathers supporting context from Slack and Google Docs, asks follow-up questions, records decisions, and reports both risk and confidence.
Tradeoffs
This is source code for Slack applications, not a hosted product or general security platform. Operators must supply Slack and OpenAI credentials, configuration, and PostgreSQL for the assessment workflow. Google Docs access uses a local browser authorization flow and writes tokens locally. Long context may be summarized and then cut off. Model output handling depends on valid JSON, retries only once, and can return without a user-facing result.
How to use it well
It best suits a security engineering team comfortable running Python services and customizing Slack workflows. Start with request triage where categories, owners, and escalation paths are already defined. Treat model decisions as structured input to human review, particularly for project risk. It does not provide vulnerability scanning, endpoint protection, cloud posture management, or a standalone analyst console.
Technical notes+
shared/openai-slackbot/openai_slackbot/bot.py builds an asynchronous Slack Bolt app, reads SLACK_BOT_TOKEN, SOCKET_APP_TOKEN, and OPENAI_API_KEY, registers message and action handlers, and runs through Socket Mode. bots/triage-slackbot/triage_slackbot/bot.py composes the shared runner with handlers and Jinja template paths, while bots/triage-slackbot/triage_slackbot/config.py validates channel IDs and converts configured categories into Pydantic models. bots/sdlc-slackbot/sdlc_slackbot/bot.py implements forms, resource fetching, context summarization, follow-ups, and risk notifications. bots/sdlc-slackbot/sdlc_slackbot/database.py uses Peewee with PostgreSQL by default and creates assessment, question, and resource tables during import. bots/sdlc-slackbot/sdlc_slackbot/utils.py calls openai.chat.completions.create with the fixed gpt-4-32k model and manually cleans JSON text. bots/sdlc-slackbot/sdlc_slackbot/gdoc.py requests read-only Google Docs access through an installed-app OAuth flow. The root Makefile installs the shared package and selected bot in editable mode and defines pytest targets for the shared package, triage bot, and incident-response bot.
Observed
- Primary language
- Python
- Application interface
- Slack bots using Slack Bolt and Socket Mode
- External model service
- OpenAI Chat Completions API
- Packaging and installation
- Setuptools packaging for the SDLC bot, with editable pip installation driven by Make targets
- Data storage
- Peewee models backed by PostgreSQL by default for SDLC assessments, questions, and resources
- Repository structure
- A shared Slack bot package plus triage, incident-response, and SDLC bot directories
- Test surface
- The Makefile defines pytest targets for the shared package, triage bot, and incident-response bot
- License
- Not stated in the provided repository text
Read from README.md, Makefile, bots/sdlc-slackbot/setup.py, bots/sdlc-slackbot/sdlc_slackbot/bot.py, bots/sdlc-slackbot/sdlc_slackbot/gdoc.py, bots/sdlc-slackbot/sdlc_slackbot/utils.py, bots/sdlc-slackbot/sdlc_slackbot/config.py, bots/triage-slackbot/triage_slackbot/bot.py, bots/sdlc-slackbot/sdlc_slackbot/database.py, bots/sdlc-slackbot/sdlc_slackbot/validate.py, shared/openai-slackbot/openai_slackbot/bot.py, bots/triage-slackbot/triage_slackbot/config.py, bots/triage-slackbot/triage_slackbot/category.py, bots/triage-slackbot/triage_slackbot/handlers.py.
What it can do
Triage security incidents automatically
Security alerts and incident reports → Prioritized and categorized security incidents
Analyze security threats and vulnerabilities
Security data, logs, and threat indicators → Detailed threat analysis reports
Generate automated security responses
Security incidents and organizational policies → Recommended response actions and workflows
Execute security response workflows
Approved response plans and system access → Implemented security countermeasures
Monitor security events in real-time
System logs and security feeds → Real-time security alerts and notifications
Generate security incident reports
Incident data and analysis results → Formatted security incident documentation
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.