Spaces:
Sleeping
Sleeping
Commit History
6 days ago
-
Add bring-your-own-key LLMs, ONNX code embeddings and security hardening
- Visitors bring their own Gemini / OpenAI / Claude key per request; keys are never stored or logged on the server - Re-add Salesforce/SFR-Embedding-Code-400M_R via its pinned ONNX export (no torch, no remote code); an adaptive time budget falls back to keyword search when embedding would be too slow for the hardware - Per-visitor sessions replace the shared global repo and chat history - Sanitize rendered LLM output (DOMPurify with SRI), CSP and security headers - Rate limiting, request size limits, safe error messages; API docs and debug output off; same-origin CORS - Harden the GitHub downloader (strict URLs, checked redirects, zip-slip and zip-bomb limits) - Per-session in-memory vector DB; non-root Docker image with the model downloaded at build time and the HF Hub offline at runtime - Trim requirements to current direct dependencies; remove runtime.txt - Index extensionless files such as Dockerfile, Makefile and LICENSE Co-Authored-By: Claude Opus 5.5 <noreply@anthro…5e9ddc1