Create a short security checklist for a browser client that submits API jobs. Keep the answer practical for a gpt-5.6-luna integration.
Keep secrets server-side, authenticate every request, validate payloads before forwarding, use short-lived signed URLs for assets, and log security-relevant failures without recording secrets. This example is tailored to the gpt-5.6-luna model page.