Generated clients are not automatically safe, their output is not frozen, and scanners should not skip them. Machine written code still carries the spec, the templates and the libraries the generator chose. Below are five common beliefs about OpenAPI generated code and what the generator documentation says about each.
Myth 1: Generated code is safe because it is machine written
Fact. A generator is a program with its own bugs and dependencies, and it faithfully turns your spec into code, including mistakes in the spec. It also adds libraries through templates, as the docs show with the Swagger annotations note. Generated code needs the same review and scanning as other code.
Myth 2: The output is the same every time
Fact. The output depends on the spec, the generator version, the templates, the config and any post process command. Change any of them and the output changes. Installing "latest" in CI makes the tool a moving part. See how to pin the generator.
Myth 3: Nobody edits generated files
Fact. People do, and the tool has a feature for it: the ignore file keeps chosen files from being overwritten. Those files stop receiving template fixes. See the ignore file post.
Myth 4: A custom template is just formatting
Fact. Templates are code that writes code. The docs example adds a logging library through a template change and a build file edit. One template line can put a new dependency or a behaviour change into every model. See custom templates.
Myth 5: Validation protects me from a bad spec
Fact. The validate command checks the document against the specification and can recommend improvements. It does not know your intent. A valid spec can name the wrong server or omit a security scheme. A skip validation flag exists in the CLI, so if it is set, even basic checking is off. Review spec diffs yourself.
Summary table
| Belief | What to do instead |
|---|---|
| Machine written means safe | Scan and review generated code |
| Output is stable | Pin the tool and templates |
| Nobody edits it | Track ignored files and review them on upgrades |
| Templates are cosmetic | Review template changes like source |
| Validation is enough | Review spec changes for intent |
One more fact
Pinning the tool is not the same as pinning what it emits. The generated project declares libraries of its own, which need a lockfile and regular updates. See what a lockfile stops and what it cannot.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, which cover the dependency side of generated clients.
Quick check
Should I exclude generated code from scanning to cut noise?
Be careful. Dependency scanning should cover it. For static analysis, exclusions can be reasonable if you record the choice. See our post on SAST exclusions for generated code.
Is generated code less likely to have injection bugs?
It can be more consistent, but that depends on the template. Test it, do not assume.
Sources
- Using Templates, OpenAPI Generator
- Customization, OpenAPI Generator
- Usage, OpenAPI Generator
- Plugins, OpenAPI Generator
Last reviewed: 19 October 2026.
