Create a short security checklist for a browser client that submits API jobs. Keep the answer practical for a gpt-5 integration.
Keep secrets server-side, authenticate every request, validate payloads before forwarding, use short-lived signed URLs for assets, and log security-relevant failures without recording secrets. This example is tailored to the gpt-5 model page.