Skip to content

SECURITY.md

Latest commit

 

History

History
31 lines (22 loc) · 1.02 KB

SECURITY.md

File metadata and controls

31 lines (22 loc) · 1.02 KB
Raw

Security Policy

Supported versions

version supported
0.4.x yes
< 0.4.0 no

Reporting a vulnerability

Please do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting: Security > Advisories > Report a vulnerability.

Include what you can of the following:

  • affected version or commit
  • the component (inference, server, export, training, packaging)
  • a minimal reproduction or proof of concept
  • expected vs actual behavior

Scope notes

OEV ships model weights, an inference API and an optional HTTP server. Points worth reporting include code execution through crafted checkpoints, unsafe deserialization, injection through question or state payloads in the server, and path handling in export tooling. Loading a checkpoint executes stored configuration, so only load checkpoints from sources you trust; the published SHA-256 hashes in BENCHMARKS.md cover the artifacts on the Hugging Face repo.