SECURITY.md

Security

Data flow

1. Gradio receives one uploaded PDF or image.
2. The Space validates size and actual content.
3. PDFium or Pillow decodes the source.
4. The first ten pages are rendered and re-encoded as normalized PNG images.
5. The original upload is deleted.
6. Only normalized PNG bytes are sent to the Cohere staging API.
7. Results remain in session memory and are not written to persistent storage.

Gradio can temporarily expose cached uploads through generated file URLs. Source files are deleted explicitly after preparation and the application cleans cached files every minute once they are ten minutes old.

Controls

• 20 MB upload ingress and handler limits.
• PDF, PNG, JPEG, and WebP content validation.
• Ten-page, 2,048-pixel-edge, and 50-megapixel limits.
• Sequential per-document API calls.
• Two concurrent parser jobs and a queue of twenty.
• Five document submissions per client per ten minutes.
• Private Gradio event endpoints and no queue bypass.
• Escaped filenames and bounding-box labels.
• Allowlisted HTML output sanitization.
• Dedicated server-side API secret.
• No file names, document text, response bodies, or credentials in logs.

Residual risks

The public application still processes untrusted files with native PDF and image libraries. Hugging Face isolates that workload from Cohere infrastructure, but the Space must use a dedicated, revocable, quota-limited credential. In-memory rate limits are per Space process and are not a replacement for a shared gateway quota.

For a higher-risk launch, run document decoding in a separate restricted worker without access to the Cohere credential, add an external rate limiter or challenge, and commission a focused security review.

Incident response

1. Pause the Space.
2. Revoke the COHERE_STG_API_KEY.
3. Review Space logs without copying document content.
4. Patch and test in private visibility.
5. Issue a new limited credential before restarting.