| # Security policy |
|
|
| ## Custom model code |
|
|
| Unlimited-OCR requires custom Python. This project never follows a floating model revision during inference. |
|
|
| `prepare`: |
|
|
| 1. downloads one pinned Baidu revision into a unique partial directory under a preparation lock; |
| 2. fully hashes every expected code, configuration, tokenizer, index, license, and weight file; |
| 3. applies exact, count-checked source transformations; |
| 4. verifies the patched tree, rejects symlinks and unexpected files, and records an exact local manifest; |
| 5. publishes the completed directory only after all checks pass. |
|
|
| `run` uses only the prepared local directory with `local_files_only=True`, `HF_HUB_OFFLINE=1`, and |
| `TRANSFORMERS_OFFLINE=1`. Those settings prevent model resolution from using the network; they are not a process sandbox. |
|
|
| ## Untrusted documents |
|
|
| Model output is untrusted Markdown/raw HTML data. The runtime does not call `eval()` on it. Output paths use an exclusive, |
| random same-directory temporary file and an atomic no-replace publish; symlinks and input/output aliases are rejected. |
| `--force` alone enables atomic replacement. |
|
|
| Images and PDFs can still trigger bugs in Pillow, PDFium/pypdfium2, PyTorch, Transformers, or the model code. PDF rendering |
| has per-page and aggregate pixel/byte limits, but hostile inputs still belong under a dedicated unprivileged account or |
| an appropriately restricted container. Do not expose this CLI directly as a public upload service without process/network |
| sandboxing, input-byte limits, timeouts, and admission controls. |
|
|
| ## Reporting |
|
|
| Please report vulnerabilities privately through GitHub's security-advisory interface for this repository. Do not include |
| private documents, credentials, model-cache tokens, or sensitive OCR output in a report. |
|
|
