OpenAI: gpt-oss-20b

Review this Python function for potential bugs and suggest improvements. Focus on edge cases and performance: def merge_sorted_lists(list1, list2): result = [] i = j = 0 while i < len(list1) and j < len(list2): if list1[i] < list2[j]: result.append(list1[i]) i += 1 else: result.append(list2[j]) j += 1 return result

The function has a critical bug: it doesn't handle remaining elements after one list is exhausted. When the while loop exits, any remaining items in list1 or list2 are silently dropped. Add `result.extend(list1[i:])` and `result.extend(list2[j:])` after the loop. For performance, consider that repeated `len()` calls in the loop condition are unnecessary — cache these values beforehand. The function also lacks input validation; passing non-list types or unsorted lists will produce incorrect results without warning. Consider adding type hints and a docstring explaining the sorted-input requirement.

This example demonstrates gpt-oss-20b's code review capability with attention to correctness over style. The 131K token context window supports reviewing entire modules, though this example stays focused. The model identifies the algorithmic flaw immediately but doesn't provide a complete rewrite — useful for learning, less so for copy-paste fixes.

Explain how OAuth 2.0 authorization code flow works to a junior developer who understands HTTP but hasn't worked with authentication systems. Include the key security considerations.

OAuth 2.0's authorization code flow keeps your app from ever seeing the user's password. Here's the sequence: (1) Your app redirects the user to the authorization server with your client_id and requested scopes. (2) User logs in there and approves access. (3) Authorization server redirects back to your app with a temporary authorization code. (4) Your app exchanges that code for an access token by making a server-to-server request that includes your client_secret. (5) You use the access token to call APIs on the user's behalf. The key security win: the access token exchange happens server-side where the client_secret stays hidden. Never expose client_secret in browser code. Always validate the redirect URI to prevent authorization code interception. Use PKCE extension for mobile apps where you can't secure a client_secret.

This showcases the model's ability to translate technical concepts into accessible explanations while preserving accuracy. The response balances conceptual flow with security specifics. At $0.14/Mtok output pricing, longer explanatory responses like this remain cost-effective compared to premium models, making gpt-oss-20b suitable for documentation generation or internal training materials.

Generate a SQL query to find the top 5 customers by total purchase amount in the last 90 days, including their email and the count of orders. Tables: customers (id, email, name), orders (id, customer_id, created_at, total_amount).

```sql SELECT c.email, c.name, SUM(o.total_amount) AS total_spent, COUNT(o.id) AS order_count FROM customers c INNER JOIN orders o ON c.id = o.customer_id WHERE o.created_at >= CURRENT_DATE - INTERVAL '90 days' GROUP BY c.id, c.email, c.name ORDER BY total_spent DESC LIMIT 5; ``` This query joins customers with their orders, filters to the 90-day window, aggregates by customer, and returns the top 5 by spend. Note: `c.id` is included in GROUP BY to ensure correct grouping even if emails aren't unique.

The model produces syntactically correct SQL with appropriate aggregation logic. The query uses standard SQL with PostgreSQL-style interval syntax — the model doesn't clarify dialect assumptions, which could cause issues on MySQL or SQL Server. The 131K context window means you can paste entire schema definitions for more accurate queries, though this simple example doesn't require it.

When gpt-oss-20b makes sense for 24/7 ticket routing at scale

A 12-person SaaS company handling 800+ support tickets daily needs instant first-pass triage without breaking the budget. gpt-oss-20b delivers here: at $0.03/Mtok input, you can route every ticket through intent classification and urgency scoring for roughly $15/day assuming 200-token average tickets. The 131k context window means you can include the last 20 customer interactions in each classification call, catching escalation patterns most models miss at this price point. Output cost sits at $0.14/Mtok, so if you're generating short labels (not full responses), your monthly bill stays under $600 even at this volume. The trade-off: no public benchmarks means you'll spend a week testing accuracy against your existing routing rules before going live. If classification accuracy falls below 85% in your tests, step up to a benchmarked alternative.

Why gpt-oss-20b handles 50-page policy documents without chunking

A 4-person policy consultancy turns 40-60 page government RFPs into 2-page executive briefs for clients, processing 15-20 documents monthly. gpt-oss-20b's 131k token window fits most full documents in a single call—no chunking, no context loss at section boundaries. At $0.03 input per million tokens, each 50-page document (roughly 35k tokens) costs about $1.05 to ingest, and a 1,500-token summary runs $0.21 to generate. Total per-document cost: $1.26 versus $4-8 for models with smaller windows that require map-reduce patterns. The risk: without published benchmark scores on long-context retrieval tasks, you're flying blind on whether it actually uses that full 131k effectively. Run a two-week pilot on past RFPs where you know the correct answer before committing your client workflow to this model.

When gpt-oss-20b wins on overnight comment queue processing

A 20-person online community platform wakes up to 3,000+ user comments each morning that need toxicity scoring before going live. gpt-oss-20b's pricing structure favors this batch pattern: you can process all 3,000 comments (averaging 80 tokens each) for roughly $7.20 in input costs, and if you're generating simple JSON verdicts (50 tokens per response), output runs another $2.10. Total daily moderation cost: under $10, or $300/month for a problem that would cost $800+ on mainstream alternatives. The 131k context window also lets you include the user's last 30 comments in each moderation call, catching repeat-offender patterns. The catch: this only works if you can tolerate 2-4 hour processing windows overnight. If you need real-time moderation (under 500ms), the lack of streaming support and unknown latency characteristics make this the wrong call.