Only the latest released version receives security fixes.

Please report vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability"). Do not open a public issue for security problems.

We aim to acknowledge reports within 7 days.

modelshelf reads and writes files in user-owned directories and talks to the Hugging Face Hub API. Reports we are especially interested in:

• path traversal or link-following bugs that could make the dedup engine write outside its allowed roots,
• registry/lock handling flaws exploitable by another local user,
• credential (HF token) leakage into logs, error messages, or persisted files.