Skip to content

Repository navigation

Security: mugilnimbus/Model-Lab

Security

docs/SECURITY.md

Security

The application is for the local machine owner. It binds loopback and has no authentication or multi-user authorization. Do not expose it as a public service.

Boundary Protection / limit
Untrusted input Checkpoints, configuration, Hub responses, names and exported attributes are treated as data
Model code Inspection does not execute downloaded code; Transformers uses trust_remote_code=False
PyTorch CPU fake tensors and weights_only=True; no unrestricted pickle fallback
Parsing Header, count, nesting, transfer and operation bounds; malformed data fails explicitly
File selection Directory/shard containment; browser folders confined to model root; linked entries excluded
Browser Escaped text, HTTPS-only external source links and foreign-origin rejection for writes
Local clients Origin checks do not authenticate command-line clients or hostile local processes
Workers Owned processes, bounded protocol and deadlines; not an OS sandbox
Windows lifetime Kill-on-close Job Objects and graceful runtime release

Private data

Data Handling
HF credentials Local HF_ACCESS_TOKEN/HF_TOKEN or ignored .env, including docs/.env; never browser/job arguments
Model paths Stay local; explicit Hub selections request repository artifacts
Prompts/captures May appear in private recorded job results; filesystem users can read them
Captures Explicit submission, selected module boundaries and byte budgets; recorded reads require workspace owner
CPU history Local timestamps/utilization, up to 30 days; not uploaded
Models/tools/logs Ignored local directories; not part of source distribution
Browser state Last source and appearance; session fallback when storage is blocked

Integrity and distribution

  • Source weights remain unchanged. Variants are staged, independently validated and hashed before publication.
  • Transfers use pinned revisions and available LFS checksums; cancellation retains resumable partials.
  • Workspace IDs correlate ownership; they are not authentication credentials.
  • Context, generation, runtime count and RAM admission are bounded. Estimates cannot guarantee a workload will fit.
  • Ignore rules exclude local data but do not remove old commits. Review current files and history before publishing.
  • GitHub Pages serves committed public docs only. Private docs and environment files must remain excluded.
  • Frontend assets are bundled locally. Parsing/runtime dependencies must remain maintained.

Contracts · Support limits

There aren't any published security advisories