Yes, they can be. A template is code that writes your code, so anything in it, such as an extra import, a logging call or a dependency line, is copied into every generated file. Keep overrides small, store them in version control, and review them like production source.
What a template is
OpenAPI Generator builds a data model from your spec and applies it to templates. Built in templates are written in Mustache and processed by jmustache. The docs also mention experimental Handlebars support and user defined template engines through plugins, starting with version 4.0.0.
You can override templates with a template directory option on the CLI, or the matching setting in the Maven and Gradle plugins. The docs say this approach only overrides existing templates. It cannot create new ones.
Lookup order explains surprises
The templating page lists the order in which the generator looks for a template:
- Your custom library path
- Your custom generator top level path
- The embedded library path
- The embedded top level path
- The common embedded path
So a file in your folder wins over the built in one. Two consequences follow. A stale override keeps silently winning after you upgrade the generator, and a copied template from an old version can hide fixes made upstream.
What to review in a template change
| Look for | Why |
|---|---|
| New dependency lines in build templates | They add libraries to every generated project |
| Added imports or helper calls | Code your team did not write, now in every model |
| Logging of request or response objects | Can leak personal data or tokens into logs |
| Hard coded URLs, headers or credentials | Ends up in a published SDK |
| Changes to the HTTP client wrapper | Affects TLS, redirects and timeouts for every call |
The docs' own example adds an aspect oriented logging library through a template and a new line in a Gradle build template. It is a good illustration of how one template edit adds a third party dependency to every output.
How to keep it manageable
- Extract only the templates you must change, using the author template command available since version 5.0. Do not copy the whole directory.
- Commit the overrides in a folder next to the spec, with the generator version they were taken from noted in the commit message.
- Require review from someone who knows the output language, since a small template edit has a wide effect.
- On each generator upgrade, diff your override against the new built in one and re-apply your change deliberately.
- Delete overrides you no longer need.
If you load templates from the classpath to share them across projects, the docs describe packaging them in a JAR. Treat that JAR as a dependency: version it, store it in your own registry, and scan it.
Where Safeguard fits
Safeguard's SBOM and dependency scanning will list any libraries your templates add, and policy gates can block a pull request that introduces a risky one. The free scan is at gold.safeguard.sh/scan.
Quick check
Can a template change run code on my build machine?
A Mustache template produces text. The risk is in what that text becomes: code that ships in your product. Running other tools on generated files is a separate feature, covered in our post on file post-processing.
Do I need custom templates at all?
Often not. Config options and additional properties cover many needs without touching templates.
Sources
Last reviewed: 19 October 2026.
