ModelFoundry model hub
All systems operational Sign in
Security

Responsible disclosure

The mirror is static, the client is a signed release artifact and the transfer endpoint is key-gated. That does not make it interesting to attack, but it does make it worth stating the rules: report privately, get a fix before a story, and do not test other people's keys.

In scope

  • The CLI and Python client, including signature and update verification
  • The runtime: model parsing, quantization, schedulers and the HTTP surface
  • The manifest, digest and verification pipeline
  • Key issuance, scoping and rotation

Out of scope

  • Findings that require physical access to a maintainer device
  • Denial of service against the mirror or the transfer endpoint
  • Attempts to use a key that is not yours, and any testing against live keys
  • Model behaviour, refusal quality or benchmark disagreements

How to report

Use the security contact listed in /.well-known/security.txt. Include the affected component, the release line, a minimal reproduction and the impact you believe it has. A proof of concept is welcome; a working exploit against a live key is not.

security.txt
Contact: mailto:security@modelfoundry.invalid
Preferred-Languages: en, ru
Encryption: signed message with the project key
Canonical: /.well-known/security.txt
Policy: https://modelfoundry.invalid/security

What happens next

  1. Acknowledge within two working days.
  2. Triage with the maintainer on rotation; severity decides the order, not enthusiasm.
  3. Fix ships in a patch release of the affected line, with an advisory in the changelog.
  4. Credit the reporter unless anonymity is preferred.
Advisories are published by release line. A quiet advisory page means nothing has been disclosed yet, not that nothing has been found.
Hardening notes

What the mirror does on purpose

Some of these are unusual, so it is worth writing down why.

No enumeration

Anonymous pull requests get a flat 401 with no model list, no count and no timing difference between a real and a fictional identifier.

Signed manifests

Every build carries a signature. A mirror that rewrites a manifest is rejected by the client rather than silently trusted.

No third-party assets

No fonts, no analytics, no CDN scripts. A static mirror that calls out to someone else is a mirror with an extra dependency.

Bounded log retention

Request metadata only, kept for abuse control, with no request bodies, no credentials and no prompt content.

Abuse control without a database

Rate limits live at the edge and expire on their own. Nothing about an anonymous reader is retained beyond the limit window.

Honest limits

Model files are parsed outside a sandbox, so we do not accept untrusted checkpoints from anonymous uploaders. Contributors build them themselves.