What "verified" means

openai

• OAI-001Audit logging is enabledhigh

  The OpenAI organization records API key, project, user and login lifecycle events.

  Answers: GAI-20

• OAI-002No API key unused for 90+ daysmedium

  Stale keys are the most common path to silent credential leaks.

  Answers: GAI-12

• OAI-003No API key older than 365 dayslow

  Long-lived keys should be rotated.

  Answers: GAI-13

• OAI-004Spend controls are configuredmedium

  An organization spend limit or per-project spend alerts cap runaway usage.

  Answers: GAI-22

• OAI-005Production projects restrict usable modelslow

  An allow-list prevents accidental use of unapproved models.

  Answers: GAI-05

• OAI-006Data retention is set explicitly per projectmedium

  Projects inheriting an unstated organization default make retention answers ambiguous.

  Answers: GAI-08

• OAI-007Owner count is small and invites are not stalelow

  Few owners and no lingering invitations limit account takeover exposure.

  Answers: GAI-11

• OAI-008Production keys belong to service accountsmedium

  Keys owned by individual users disappear or leak when people leave.

  Answers: GAI-12

• OAI-009Rate limits are tuned on active projectslow

  Project-level rate limits below the organization default contain abuse and bugs.

  Answers: GAI-23

• OAI-010Models used in the last 30 daysinfo

  Inventory of models actually called, from usage data.

  Answers: GAI-03

anthropic

• ANT-001No active API key in an archived workspacemedium

  Keys that outlive their workspace are forgotten credentials.

  Answers: GAI-12

• ANT-002Production keys live in a dedicated workspacemedium

  Keys in the default workspace cannot be scoped, limited or reported separately.

  Answers: GAI-14

• ANT-003No active key older than 365 dayslow

  Long-lived keys should be rotated.

  Answers: GAI-13

• ANT-004Admin count is small and invites are not stalelow

  Few admins and no lingering invitations limit account takeover exposure.

  Answers: GAI-11

• ANT-005Workspace spend limitsmedium

  Workspace spend limits cap runaway usage. Readable only on plans that expose them.

  Answers: GAI-22

• ANT-006Models used in the last 30 daysinfo

  Inventory of models actually called, from the usage analytics API.

  Answers: GAI-03

cloudflare ai gateway

• AIG-001Gateways require authenticationhigh

  An unauthenticated gateway lets anyone who knows the URL spend your provider credits.

  Answers: GAI-14

• AIG-002Prompt logging is either off or covered by DLPmedium

  Stored prompts and responses are customer data; if kept, they should be scanned.

  Answers: GAI-08, GAI-09

• AIG-003Rate limiting is configuredmedium

  Per-gateway rate limits contain abuse and runaway loops.

  Answers: GAI-23

• AIG-004Spend limits are set for third-party providersmedium

  Dollar-based limits stop a leaked key or a bug from producing a surprise bill.

  Answers: GAI-22

• AIG-005Stored provider keys cannot fall back to Unified Billinglow

  With BYOK keys stored, byok_only prevents silent billing to Cloudflare credits.

  Answers: GAI-14

• AIG-006Guardrails are enabledlow

  Guardrails flag or block harmful prompts and responses across providers.

  Answers: GAI-17

• AIG-007Providers and models used in the last 30 daysinfo

  Inventory from AI Gateway analytics.

  Answers: GAI-03, GAI-04

cloudflare account

• WRK-001Workers hold provider API keys directlymedium

  A Worker secret named like a provider key means the Worker calls the provider itself, outside AI Gateway's logging, limits and key storage.

  Answers: GAI-04, GAI-14

• WRK-002AI Workers have observability enabledlow

  Without Workers Logs there is no record of what an AI Worker did when something goes wrong.

  Answers: GAI-20

• WRK-003AI Workers are not exposed only on workers.devmedium

  A workers.dev hostname has no zone-level WAF rules, rate limiting rules or Access policies.

  Answers: GAI-23

• WRK-004MCP servers are behind Cloudflare Accesshigh

  An MCP server reachable without Access lets any client enumerate and call its tools.

  Answers: GAI-14

• ZONE-001LLM endpoints have a rate limiting rulehigh

  Cloudflare labels LLM endpoints automatically (cf-llm). Each should be covered by a rate limiting rule.

  Answers: GAI-23

• ZONE-002Zones with LLM endpoints have bot protection or custom rulesmedium

  LLM endpoints attract scripted abuse; at least Bot Fight Mode or a custom rule should apply.

  Answers: GAI-23

• ACC-001AI surface inventoryinfo

  Workers using AI bindings or provider keys, and zones with LLM endpoints.

  Answers: GAI-21

repo

• REPO-001No direct calls to model-provider hostshigh

  Source code that targets api.openai.com, api.anthropic.com and similar bypasses any gateway, so those calls have no central logging, limits or key management.

  Answers: GAI-04

• REPO-002Provider SDKs are configured through a gatewaymedium

  A provider SDK with no gateway reference in the same file is almost certainly calling the provider directly.

  Answers: GAI-04

• REPO-003Workers AI calls go through a gatewaylow

  env.AI.run without a gateway id has no logs, caching, rate limits or spend limits.

  Answers: GAI-04

• REPO-004No provider secrets in plaintext configurationhigh

  Wrangler vars are committed in plaintext; provider keys belong in secrets or AI Gateway BYOK.

  Answers: GAI-12

• REPO-005MCP servers verify callersmedium

  An MCP server without an Access or OAuth check will serve any client that finds the URL.

  Answers: GAI-14

• REPO-006AI Workers enable observability in configurationlow

  Workers Logs should be on for any Worker with an AI binding.

  Answers: GAI-20

• REPO-007Provider key variable namesinfo

  Inventory of configuration variables that look like provider keys (names only).

  Answers: GAI-21

Generic AI security appendix

1. GAI-01Describe the AI/ML features in your product and their purpose.
2. GAI-02Which third-party AI providers do you use?
3. GAI-03Which models are in use, and how are new models approved?
4. GAI-04Do you route AI traffic through a gateway or proxy with central controls?
5. GAI-05How do you restrict which models your systems may call?
6. GAI-06Is customer data used to train or fine-tune any model, by you or your providers?
7. GAI-07What contractual terms (DPA, zero data retention) are in place with AI providers?
8. GAI-08What is the retention period for prompts and outputs at each provider and in your systems?
9. GAI-09Do you scan prompts or outputs for sensitive data (DLP)?
10. GAI-10Where is AI data processed and stored (regions)?
11. GAI-11Who administers your AI provider accounts, and how is access reviewed?
12. GAI-12How are AI provider API keys issued, owned, reviewed and revoked?
13. GAI-13How often are AI provider credentials rotated?
14. GAI-14How are production AI credentials segregated from development and from individuals?
15. GAI-15Is there a human in the loop for AI outputs that affect customers?
16. GAI-16How do you prevent and detect prompt injection?
17. GAI-17What content safety controls or guardrails are applied to prompts and outputs?
18. GAI-18How are AI-related incidents detected, handled and communicated?
19. GAI-19List all subprocessors involved in AI features.
20. GAI-20Is administrative activity on AI provider accounts logged and reviewed?
21. GAI-21Do you maintain an inventory (AI bill of materials) of models and providers?
22. GAI-22What cost and usage limits protect against abuse or runaway consumption?
23. GAI-23What rate limits apply to AI endpoints?
24. GAI-24Which AI governance frameworks do you align to (ISO 42001, NIST AI RMF)?
25. GAI-25Can customers opt out of AI features?