| { |
| "format": 1, |
| "base_model": "LiquidAI/LFM2.5-Encoder-350M", |
| "models": { |
| "fp32": "model.onnx", |
| "q8": "model_q8.onnx", |
| "q8_wasm": "model_q8_wasm.onnx" |
| }, |
| "external_data": { |
| "model_q8.onnx": [ |
| "model_q8.weights" |
| ], |
| "model_q8_wasm.onnx": [ |
| "model_q8.weights" |
| ] |
| }, |
| "use": { |
| "native": "q8 (or fp32)", |
| "webgpu": "q8", |
| "wasm": "q8_wasm" |
| }, |
| "inputs": [ |
| "input_ids" |
| ], |
| "output": "logits", |
| "batch": "one unpadded window per run", |
| "labels": [ |
| "cwe_79", |
| "cwe_787", |
| "cwe_89", |
| "cwe_352", |
| "cwe_22", |
| "cwe_125", |
| "cwe_78", |
| "cwe_416", |
| "cwe_862", |
| "cwe_434", |
| "cwe_94", |
| "cwe_20", |
| "cwe_77", |
| "cwe_287", |
| "cwe_269", |
| "cwe_502", |
| "cwe_200", |
| "cwe_863", |
| "cwe_918", |
| "cwe_119", |
| "cwe_476", |
| "cwe_798", |
| "cwe_190", |
| "cwe_400", |
| "cwe_306" |
| ], |
| "questions": { |
| "cwe_79": "Is untrusted data placed into HTML, JavaScript or a template here without escaping for the context it lands in?", |
| "cwe_787": "Can a write here go past the end or before the start of the allocated buffer?", |
| "cwe_89": "Is a SQL query built here by concatenating or interpolating data, rather than by binding parameters?", |
| "cwe_352": "Does this code define a server-side handler for a state-changing web request (POST, PUT, PATCH or DELETE) that trusts a cookie or session for who the caller is, without checking an anti-forgery token, SameSite cookie or equivalent?", |
| "cwe_22": "Is a filesystem path built here from input that could be attacker-influenced, without being confined to a base directory?", |
| "cwe_125": "Can a read here take an index or pointer past the end or before the start of a buffer?", |
| "cwe_78": "Is a shell or operating-system command built or executed here from data that could be attacker-influenced?", |
| "cwe_416": "Is a pointer used here -- read, written, passed on or freed again -- after the memory it points to has already been freed?", |
| "cwe_862": "Does this code let a caller read or change data that belongs to someone else, or perform an administrative action, without checking that this particular caller is allowed to? Being logged in is not such a check.", |
| "cwe_434": "Does this code store a file received from a remote sender (an upload or download) using a name, extension or path that the sender controls, without restricting it?", |
| "cwe_94": "Is source code, a template or an expression compiled or evaluated here from data rather than from a literal?", |
| "cwe_20": "Is data that arrives from outside the program (a request, file, socket, argv or environment variable) used here in an operation where an unexpected type, length or format would cause harm, with no check of it in the code shown?", |
| "cwe_77": "Is a command string or argument list assembled here from data that could change which command runs?", |
| "cwe_287": "Can an identity be asserted or accepted here without the credential actually being verified?", |
| "cwe_269": "Are privileges granted, raised or left un-dropped here in a way a caller could exploit?", |
| "cwe_502": "Is serialized data deserialized here in a way that could instantiate types or run code chosen by the data?", |
| "cwe_200": "Does this code expose secrets, credentials, tokens, internal paths or stack traces to a caller or a log?", |
| "cwe_863": "Is an authorization check present here but wrong, incomplete or bypassable?", |
| "cwe_918": "Is a network request issued here to a host, port or URL that could be attacker-influenced?", |
| "cwe_119": "Is a memory buffer operated on here without the operation being bounded to the buffer's real size?", |
| "cwe_476": "Is a pointer or reference dereferenced here right after an operation that can return null (an allocation, lookup, parse or optional result) without a check for null?", |
| "cwe_798": "Does this code contain an embedded password, API key, token, certificate or private key?", |
| "cwe_190": "Is a fixed-width integer computed here (in C, C++, Rust, Go, Java or similar) that could wrap or truncate and then be used as a size, index, length or offset?", |
| "cwe_400": "Can attacker-influenced input drive unbounded memory, recursion, iteration or file growth here?", |
| "cwe_306": "Does this code define an entry point reachable over a network (an HTTP route, RPC method or socket handler) that performs a sensitive or destructive action without checking who the caller is anywhere in the code shown?" |
| }, |
| "limits": { |
| "cwe_79": {}, |
| "cwe_787": { |
| "Langs": [ |
| "c", |
| "cpp" |
| ] |
| }, |
| "cwe_89": {}, |
| "cwe_352": {}, |
| "cwe_22": {}, |
| "cwe_125": { |
| "Langs": [ |
| "c", |
| "cpp" |
| ] |
| }, |
| "cwe_78": {}, |
| "cwe_416": { |
| "Langs": [ |
| "c", |
| "cpp" |
| ] |
| }, |
| "cwe_862": {}, |
| "cwe_434": {}, |
| "cwe_94": {}, |
| "cwe_20": {}, |
| "cwe_77": {}, |
| "cwe_287": {}, |
| "cwe_269": {}, |
| "cwe_502": {}, |
| "cwe_200": {}, |
| "cwe_863": {}, |
| "cwe_918": {}, |
| "cwe_119": { |
| "Langs": [ |
| "c", |
| "cpp" |
| ] |
| }, |
| "cwe_476": { |
| "NotLangs": [ |
| "html", |
| "css", |
| "sql", |
| "hcl", |
| "dockerfile" |
| ] |
| }, |
| "cwe_798": {}, |
| "cwe_190": { |
| "NotLangs": [ |
| "python", |
| "javascript", |
| "typescript", |
| "tsx", |
| "bash", |
| "powershell", |
| "php", |
| "ruby", |
| "lua", |
| "html", |
| "css", |
| "sql", |
| "clojure", |
| "elixir", |
| "hcl", |
| "dockerfile" |
| ] |
| }, |
| "cwe_400": {}, |
| "cwe_306": {} |
| }, |
| "temperature": 1.635569023702627, |
| "max_length": 8192, |
| "tokens": { |
| "bos": 1, |
| "pad": 0 |
| }, |
| "window": { |
| "lines": 240, |
| "stride": 240, |
| "budget_chars": 33084, |
| "line_cap": 400, |
| "cut": " ... [long line cut]", |
| "header": "// ==== {path}:{from}-{to} of {total} ====", |
| "line": "{n} | {text}", |
| "binary_probe_bytes": 8192 |
| }, |
| "extensions": { |
| "py": "python", |
| "ts": "typescript", |
| "tsx": "tsx", |
| "js": "javascript", |
| "mjs": "javascript", |
| "cjs": "javascript", |
| "go": "go", |
| "java": "java", |
| "rs": "rust", |
| "c": "c", |
| "h": "cpp", |
| "cpp": "cpp", |
| "cc": "cpp", |
| "cxx": "cpp", |
| "hpp": "cpp", |
| "hh": "cpp", |
| "hxx": "cpp", |
| "cs": "c_sharp", |
| "php": "php", |
| "rb": "ruby", |
| "swift": "swift", |
| "kt": "kotlin", |
| "kts": "kotlin", |
| "dart": "dart", |
| "scala": "scala", |
| "ex": "elixir", |
| "exs": "elixir", |
| "html": "html", |
| "htm": "html", |
| "css": "css", |
| "sh": "bash", |
| "sql": "sql", |
| "lua": "lua", |
| "sol": "solidity", |
| "ps1": "powershell", |
| "psm1": "powershell", |
| "psd1": "powershell", |
| "tf": "hcl", |
| "tfvars": "hcl", |
| "hcl": "hcl", |
| "cls": "apex", |
| "clj": "clojure", |
| "edn": "clojure", |
| "ml": "ocaml" |
| }, |
| "skip_dirs": [ |
| ".git", |
| ".hg", |
| ".mypy_cache", |
| ".svn", |
| ".tox", |
| ".venv", |
| "__pycache__", |
| "node_modules", |
| "venv" |
| ] |
| } |
|
|
