rules-huggingface

trust_remote_code=True allows the model repository to execute arbitrary Python code on your machine during model loading — a critical RCE vector. Only set this for repositories you have personally audited. Pin the revision parameter to a specific commit hash so future repo changes cannot inject new code: from_pretrained(..., revision='abc123', trust_remote_code=True).

load_dataset(..., trust_remote_code=True) runs the dataset's loading script on your machine. A malicious or compromised dataset repository can execute arbitrary code. Review the dataset loading script before enabling this flag, and pin the revision.

HuggingFace API token hardcoded in source code. Tokens exposed in git history give read/write access to all your private models and datasets. Use os.environ['HF_TOKEN'] or login() via the CLI and store the token in ~/.cache/huggingface/token.

pipeline(..., trust_remote_code=True) executes arbitrary code from the model repository. Same risk as from_pretrained with trust_remote_code — pin a specific revision hash and only use audited repositories.

torch.load() deserializes Python pickles by default, enabling arbitrary code execution from untrusted .pt/.pth model files (CWE-502). Use torch.load(..., weights_only=True) (PyTorch ≥2.0) to restrict deserialization to tensor data only, or use safetensors format.

Loading a HuggingFace model without pinning a revision= hash means future pushes to the repo can silently change the model weights or tokenizer. Pin the exact commit: from_pretrained('org/model', revision='<commit-sha>') to ensure reproducibility and supply-chain integrity.