modelaudit 0.2.35__tar.gz → 0.2.37__tar.gz

modelaudit-0.2.37/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.37"
+}

{modelaudit-0.2.35 → modelaudit-0.2.37}/AGENTS.md

@@ -28,7 +28,7 @@ uv sync --extra all-ci
 uv run ruff format modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
 uv run ruff check --fix modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
 uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
-uv run pytest -n auto -m "not slow and not integration" --maxfail=1
+PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -n auto -m "not slow and not integration" --maxfail=1
 ```
 
 ## Standard Workflow
@@ -74,7 +74,7 @@ gh pr create --title "feat: descriptive title" --body "Brief description"
 uv run ruff check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/          # Lint (no errors)
 uv run ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/ # Format (no changes)
 uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/                # Types (no errors)
-uv run pytest -n auto -m "not slow and not integration" --maxfail=1
+PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -n auto -m "not slow and not integration" --maxfail=1
 ```
 
 | Issue               | Fix                                                                                                                             |
@@ -111,6 +111,7 @@ uv run pytest -n auto -m "not slow and not integration" --maxfail=1
 - Keep fixtures deterministic and self-contained under `tmp_path`; never rely on host paths or global temp filenames.
 - If a new regression test must run on reduced CI lanes, add the file to `allowed_test_files` in `tests/conftest.py`.
 - Match local validation to the CI lane that will exercise the change when possible; if optional dependencies or Python-version gates prevent that, call it out explicitly in the PR.
+- Disable telemetry for local validation unless the task explicitly tests telemetry behavior: prefix pytest runs with `PROMPTFOO_DISABLE_TELEMETRY=1` (or `NO_ANALYTICS=1`). Requests to contact `a.promptfoo.app` during normal unit, scanner, or integration-excluded test runs are ok and expected for this project; approve them when the test runner requests access. Telemetry tests should still mock the transport or make network intent explicit before running.
 - For file routing, prefiltering, or archive-triage changes, add at least one malicious positive regression and one benign near-match negative regression.
 - Reuse shared fixture helpers for container formats. For PyTorch ZIP tests, prefer
   `tests.helpers.create_mock_pytorch_zip`; if you hand-roll a ZIP-backed `.pt`/`.pkl`,

{modelaudit-0.2.35 → modelaudit-0.2.37}/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.2.37](https://github.com/promptfoo/modelaudit/compare/v0.2.36...v0.2.37) (2026-04-12)
+
+### Bug Fixes
+
+- add CVE scanner coverage ([01dec02](https://github.com/promptfoo/modelaudit/commit/01dec0270516738295651ce07e7804de82eaabdb))
+- add size floor for zip compression ratio ([#949](https://github.com/promptfoo/modelaudit/issues/949)) ([5e66eeb](https://github.com/promptfoo/modelaudit/commit/5e66eeb483048644da7c07bba6496a5c6c73a187))
+- align SARIF scan metadata with CLI results ([#934](https://github.com/promptfoo/modelaudit/issues/934)) ([1a90415](https://github.com/promptfoo/modelaudit/commit/1a90415d53d9ddc4dba01ff7ad804125a1d76c20))
+- allow generated TorchScript source files ([#948](https://github.com/promptfoo/modelaudit/issues/948)) ([53d0cdc](https://github.com/promptfoo/modelaudit/commit/53d0cdc48025628de0f56397d832dbac839721fd))
+- **archives:** honor nested header routing ([fccdb91](https://github.com/promptfoo/modelaudit/commit/fccdb914ccd87d0f178729f6becdfdddcfe72024))
+- avoid archive bin pickle routing ([#962](https://github.com/promptfoo/modelaudit/issues/962)) ([446df6b](https://github.com/promptfoo/modelaudit/commit/446df6b06a59cf6cc8e11485d6df8f5dc0d35ec8))
+- avoid safetensors unicode metadata false positive ([#945](https://github.com/promptfoo/modelaudit/issues/945)) ([d595fde](https://github.com/promptfoo/modelaudit/commit/d595fdee57150ea22d9bb38b92ec61cdc865da60))
+- bound standalone pickle stream reads ([4d0cb84](https://github.com/promptfoo/modelaudit/commit/4d0cb84af010b4ed332ebbf17fc8bd0769fa8b6e))
+- **catboost:** redact finding urls ([c65334c](https://github.com/promptfoo/modelaudit/commit/c65334ceb456556835d80bf17010d952c7437985))
+- **cli:** honor streaming file skips ([49291ac](https://github.com/promptfoo/modelaudit/commit/49291acbc9fb8c35f7944ee894fd81ac23fe3045))
+- **cli:** redact cloud urls in output ([#964](https://github.com/promptfoo/modelaudit/issues/964)) ([0ee82ca](https://github.com/promptfoo/modelaudit/commit/0ee82ca1e84f2dc06daa8d05a4ad9c3abdc85987))
+- default unknown severities to info ([#963](https://github.com/promptfoo/modelaudit/issues/963)) ([9b27b9a](https://github.com/promptfoo/modelaudit/commit/9b27b9ac672009a77a413aeea1fea350f6df145c))
+- **deps:** update dependency tensorflow to >=2.21,<2.22 ([#985](https://github.com/promptfoo/modelaudit/issues/985)) ([2e3ac65](https://github.com/promptfoo/modelaudit/commit/2e3ac651e2bb0b83d87d070c00894eeddcf0091d))
+- **detectors:** redact network urls in findings ([7e28a46](https://github.com/promptfoo/modelaudit/commit/7e28a46c6de3f5646d42b14fd76061fdfeaf114e))
+- **dvc:** restrict target paths ([3bd9b68](https://github.com/promptfoo/modelaudit/commit/3bd9b685a3e3bb5de87d3775a9704deb7f4a253b))
+- flag pickle persistent ids ([#938](https://github.com/promptfoo/modelaudit/issues/938)) ([2cfba40](https://github.com/promptfoo/modelaudit/commit/2cfba403e21d53f46ba7089b655cebc564dcddaf))
+- **gguf:** detect tensor bounds overflow ([a4358ff](https://github.com/promptfoo/modelaudit/commit/a4358ffe0e3b8a8d8729b8bcf23a8f00f205a5e1))
+- honor header-routed scanners ([#941](https://github.com/promptfoo/modelaudit/issues/941)) ([6740260](https://github.com/promptfoo/modelaudit/commit/6740260c36331156eb6f7fc491d58f5b570dbee4))
+- **huggingface:** redact source urls ([73b538e](https://github.com/promptfoo/modelaudit/commit/73b538e21ccf23c5ef452b16153c1e6e2b8e6663))
+- ignore pmml documentation urls ([506aa75](https://github.com/promptfoo/modelaudit/commit/506aa7510a820e4c01018231cb52be4f5964334f))
+- **jfrog:** redact url secrets ([4546eee](https://github.com/promptfoo/modelaudit/commit/4546eeeadad7a8fadd31e21cf550a44688f0d076))
+- **keras:** redact archive urls ([e532b0d](https://github.com/promptfoo/modelaudit/commit/e532b0dd67d2f7033c29644356efe8a220060441))
+- **lightgbm:** redact finding urls ([d4f1fe2](https://github.com/promptfoo/modelaudit/commit/d4f1fe2a61e51166bf48c74861ff7cb31f55a69c))
+- **manifest:** redact url secrets ([c831733](https://github.com/promptfoo/modelaudit/commit/c83173316cf98d9f19b0a8481a40b848077d0096))
+- mark missing numpy format as operational ([#958](https://github.com/promptfoo/modelaudit/issues/958)) ([6d271d6](https://github.com/promptfoo/modelaudit/commit/6d271d6eb4e3faf38bf03ae3db76ce9d369ce4af))
+- mark pickle parse failures inconclusive ([8a0e3fd](https://github.com/promptfoo/modelaudit/commit/8a0e3fd125ec6e4d49f72ab68d43d1c6544d3ae0))
+- **metadata:** redact suspicious urls ([7af0d4d](https://github.com/promptfoo/modelaudit/commit/7af0d4d1dbe8a6c6d87870f3a0b5989c91bb35d1))
+- **metadata:** reject symlink escapes ([3869cf0](https://github.com/promptfoo/modelaudit/commit/3869cf0492fa1db7418269c8263b42f65a130a07))
+- narrow flax suspicious key criticals ([#957](https://github.com/promptfoo/modelaudit/issues/957)) ([9276d24](https://github.com/promptfoo/modelaudit/commit/9276d2472c18cda02a559c1f451fa65c91bdbcf1))
+- narrow network c2 metadata patterns ([fd9cc41](https://github.com/promptfoo/modelaudit/commit/fd9cc410440568cbb1ef0c17fea03499c16441e9))
+- narrow openvino external library checks ([#959](https://github.com/promptfoo/modelaudit/issues/959)) ([e895872](https://github.com/promptfoo/modelaudit/commit/e895872612c15bfd016f9a9e1fb58262ff4ee1eb))
+- narrow safetensors path metadata checks ([#955](https://github.com/promptfoo/modelaudit/issues/955)) ([4241780](https://github.com/promptfoo/modelaudit/commit/42417800670c4fb49d8bf2ea9b46aec702550485))
+- narrow suspicious dunder string detection ([#947](https://github.com/promptfoo/modelaudit/issues/947)) ([e866760](https://github.com/promptfoo/modelaudit/commit/e8667609d293d4391205ce4e8884fa3559030604))
+- **nemo:** scan referenced non-checkpoint suffixes ([3ba4ff7](https://github.com/promptfoo/modelaudit/commit/3ba4ff76399987dbcaf7b56c1a23f0d0a3c0a205))
+- **openvino:** flag sidecar symlink escapes ([772e796](https://github.com/promptfoo/modelaudit/commit/772e796c73b1b05172225af27a6dabf6c5254aae))
+- **openvino:** redact library urls ([241a667](https://github.com/promptfoo/modelaudit/commit/241a667dd658f1e0a827a05d3ddef5d13717f357))
+- preserve informational network findings ([b39d312](https://github.com/promptfoo/modelaudit/commit/b39d3124bf0b8578ae79919c726a28d7731261a4))
+- reduce benign Keras Lambda bytecode noise ([8cb5c29](https://github.com/promptfoo/modelaudit/commit/8cb5c29308673f52e9a9f2b7186cdd37c9657214))
+- require nested pickle execution evidence ([d2ad631](https://github.com/promptfoo/modelaudit/commit/d2ad6314f4df70ae03064f78ef37ddd6c8de8f53))
+- route nested compressed archive members ([e217b29](https://github.com/promptfoo/modelaudit/commit/e217b2982609a1888450c3d4ae9bd29726e187d4))
+- route nested compressed members ([#944](https://github.com/promptfoo/modelaudit/issues/944)) ([d839fe7](https://github.com/promptfoo/modelaudit/commit/d839fe734ccdabb62401970f4b652048156707ec))
+- **r:** redact serialized urls ([013bcf0](https://github.com/promptfoo/modelaudit/commit/013bcf0056b63f850ff569062ca3f6c64cfdbd9a))
+- **scanners:** redact evidence secrets ([3ae1383](https://github.com/promptfoo/modelaudit/commit/3ae13834844cd1cffc3975379e3ab8550309dc83))
+- skip prose-only network references ([773eb88](https://github.com/promptfoo/modelaudit/commit/773eb881187ef3b6601c9650e5bd4c8c17ec939c))
+- skip protocol-only streaming pickle warning ([#961](https://github.com/promptfoo/modelaudit/issues/961)) ([dba3ebe](https://github.com/promptfoo/modelaudit/commit/dba3ebec5c19ea86b1e40012ff0ffce8d81af451))
+- tighten pytorch zip pickle discovery ([#953](https://github.com/promptfoo/modelaudit/issues/953)) ([bfd9663](https://github.com/promptfoo/modelaudit/commit/bfd9663f68e30213fa8bb76016815dfbfdbdd968))
+- **torchserve:** redact manifest urls ([4626a02](https://github.com/promptfoo/modelaudit/commit/4626a02450b5436cc994329662b5e1623d2d6b00))
+
+### Documentation
+
+- add scanner CVE gap analysis ([73d6e8e](https://github.com/promptfoo/modelaudit/commit/73d6e8e512f0d86c7307df69a5663e3223724196))
+- allow promptfoo telemetry approval ([1fbe64c](https://github.com/promptfoo/modelaudit/commit/1fbe64cbe071579ebbb8064980cd05cf27133f2c))
+
+## [0.2.36](https://github.com/promptfoo/modelaudit/compare/v0.2.35...v0.2.36) (2026-04-11)
+
+### Documentation
+
+- disable telemetry during agent validation ([#928](https://github.com/promptfoo/modelaudit/issues/928)) ([69a1986](https://github.com/promptfoo/modelaudit/commit/69a1986aa2a63ab07e63871507e96bf857c1c882))
+
 ## [0.2.35](https://github.com/promptfoo/modelaudit/compare/v0.2.34...v0.2.35) (2026-04-11)
 
 ### Bug Fixes
@@ -79,28 +144,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - reduce PMML subprocess extension false positives ([#869](https://github.com/promptfoo/modelaudit/issues/869)) ([5e6f79d](https://github.com/promptfoo/modelaudit/commit/5e6f79dc134267202b5a4b841a8946af865ebd15))
 - tolerate bounded CoreML custom block truncation ([#868](https://github.com/promptfoo/modelaudit/issues/868)) ([34df06d](https://github.com/promptfoo/modelaudit/commit/34df06dd2c12b69815a2a15f1273085856bebf64))
 
-## [Unreleased]
-
-### Bug Fixes
-
-- mark trailing bytes after NumPy object-array pickle payloads inconclusive without escalating to security findings
-- avoid CoreML nested parse failures on bounded-read truncation
-- mark incomplete sharded-model scans as inconclusive, ignore shard-name prefix matches, and skip caching explicit incomplete outcomes
-- flag TensorFlow `LoadLibrary` and `LoadLibraryV2` graph ops as dangerous native-library loading
-- detect split CNTK native-user-function and native-library references
-- detect Linux/macOS native-library members in Keras archives and uppercase native-library members in PyTorch ZIPs
-- detect embedded Windows DLL/PE, Linux ELF shared-object, and TensorRT plugin entry-point markers in TensorRT engines
-- detect punctuation-delimited TensorRT `/tmp` plugin paths
-- clean up temporary ZIP entry files when extraction fails on entry size limits
-- preserve HuggingFace cache provenance for symlinked custom cache roots
-- mark ONNX tensor dtype validation failures inconclusive instead of allowing clean scans
-- ignore remote OCI `layers[].urls` entries during local layer discovery
-- fail closed on unterminated OpenVINO DOCTYPE declarations
-- avoid PMML `<Extension>` false positives for benign `subprocess` prose while preserving `subprocess.getoutput()`, `subprocess.getstatusoutput()`, and `importlib.import_module("subprocess")` detections
-- mark incomplete ZIP, TAR, and 7z archive traversals as inconclusive in scan metadata
-- route helper-level ZIP-backed `.ckpt`/`.pkl` checkpoints through archive scanners
-- harden standalone pickle scanner dangerous global coverage, nested payload bounds, incomplete-scan reporting, and standalone-primary migration behavior
-
 ## [0.2.31](https://github.com/promptfoo/modelaudit/compare/v0.2.30...v0.2.31) (2026-04-04)
 
 ### Bug Fixes

{modelaudit-0.2.35 → modelaudit-0.2.37}/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13-slim@sha256:eefe082c4b73082d83b8e7705ed999bc8a1dae57fe1ea723f907a0fc4b90f088
+FROM python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
 
 WORKDIR /app
 

{modelaudit-0.2.35 → modelaudit-0.2.37}/Dockerfile.full

@@ -1,4 +1,4 @@
-FROM python:3.13-slim@sha256:eefe082c4b73082d83b8e7705ed999bc8a1dae57fe1ea723f907a0fc4b90f088
+FROM python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
 
 WORKDIR /app
 

{modelaudit-0.2.35 → modelaudit-0.2.37}/Dockerfile.tensorflow

@@ -1,4 +1,4 @@
-FROM python:3.13-slim@sha256:eefe082c4b73082d83b8e7705ed999bc8a1dae57fe1ea723f907a0fc4b90f088
+FROM python:3.13-slim@sha256:d168b8d9eb761f4d3fe305ebd04aeb7e7f2de0297cec5fb2f8f6403244621664
 
 WORKDIR /app
 

{modelaudit-0.2.35 → modelaudit-0.2.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modelaudit
-Version: 0.2.35
+Version: 0.2.37
 Summary: Static scanning library for detecting malicious code, backdoors, and other security risks in ML model files
 Project-URL: Repository, https://github.com/promptfoo/modelaudit
 Project-URL: Homepage, https://github.com/promptfoo/modelaudit
@@ -111,7 +111,7 @@ Requires-Dist: safetensors>=0.4.0; extra == 'safetensors'
 Provides-Extra: sevenzip
 Requires-Dist: py7zr>=0.20.1; extra == 'sevenzip'
 Provides-Extra: tensorflow
-Requires-Dist: tensorflow<3.0,>=2.17.0; (python_version >= '3.11' and python_version < '3.13') and extra == 'tensorflow'
+Requires-Dist: tensorflow<2.22,>=2.21; (python_version >= '3.11' and python_version < '3.13') and extra == 'tensorflow'
 Provides-Extra: tensorrt
 Requires-Dist: tensorrt>=8.6.0; (sys_platform == 'linux' or sys_platform == 'win32') and extra == 'tensorrt'
 Provides-Extra: tflite

{modelaudit-0.2.35 → modelaudit-0.2.37}/docs/agents/architecture.md

@@ -3,7 +3,8 @@
 ## Core Components
 
 - `cli.py`: Click-based CLI interface
-- `core.py`: Main scanning logic and file traversal
+- `core.py`: Main scanning logic, file traversal, routing, and scanner invocation
+- `core_results.py`: Aggregate result helpers, exit-code semantics, check consolidation, and asset/metadata attachment
 - `metadata_extractor.py`: Metadata extraction command backend (`modelaudit metadata`)
 - `scanner_results.py`: Leaf result/check/issue contracts re-exported by `scanners/base.py`
 - `scanner_registry_metadata.py`: Static scanner metadata consumed by registry loading and extension utilities
@@ -15,7 +16,8 @@
 ## Routing & Coverage Invariants
 
 - Prefer trusted file structure and bounded content sniffing over extension-only routing, especially for ZIP-like containers and nested archives.
-- Keep scanner routing metadata descriptor-owned in `ScannerRegistry`; header-format aliases, content-routed extensions, and lazy class exports should come from one descriptor entry, with `can_handle()` as the final content gate.
+- Keep scanner routing metadata descriptor-owned in `scanner_registry_metadata.py`; header-format aliases, content-routed extensions, extension-only format policy, and lazy class exports should come from that descriptor module, with `can_handle()` as the final content gate.
+- Source discovery filters should consume the registry-backed scannable extension set instead of carrying local allowlists.
 - For routing, prefiltering, or archive-recursion changes, add one malicious positive regression and one benign near-match negative regression.
 - If a scanner aborts to avoid partial coverage, make the result operationally explicit (`success=False` with a clear error message) and preserve consistent exit-code and cache behavior.
 
@@ -103,6 +105,7 @@ result.add_check(
 - `modelaudit/scanners/base.py`: Scanner interface and base classes
 - `modelaudit/scanners/<scanner>_support/`: Extracted helper modules for large scanners while preserving public `<scanner>_scanner.py` entrypoints
 - `modelaudit/core.py`: Main scanning orchestration logic
+- `modelaudit/core_results.py`: Shared result aggregation/finalization logic used by core scan flows
 - `modelaudit/cli.py`: Command-line interface
 - `pyproject.toml`: Dependencies and project configuration
 - `tests/conftest.py`: Test configuration and fixtures

{modelaudit-0.2.35 → modelaudit-0.2.37}/docs/agents/new-scanner-quickstart.md

@@ -55,12 +55,13 @@ class ExampleScanner(BaseScanner):
 
 ## 3. Register the scanner
 
-Update `modelaudit/scanners/__init__.py` in `ScannerRegistry._init_registry`:
+Update `modelaudit/scanner_registry_metadata.py`:
 
 - Add one scanner descriptor entry with module/class metadata
 - Set priority, direct extensions, and any descriptor-owned `header_formats` / `content_routed_extensions` carefully
 - Declare dependency names for load-time diagnostics
 - Document intentional descriptor/class extension differences with `scanner_only_extensions` instead of leaving silent drift
+- If the extension is authoritative enough for extension-only format validation, add it to the descriptor-owned `EXTENSION_FORMAT_MAP`; leave generic text/config extensions out
 - Do not add a second class map in `__getattr__`; lazy exports are resolved from descriptor metadata
 
 ## 4. Dependency handling rules

{modelaudit-0.2.35 → modelaudit-0.2.37}/docs/maintainers/format-gap-plans/coreml-mlmodel.md

@@ -58,8 +58,8 @@ Out of scope:
 
 1. Routing and registration
 
-- Add scanner entry and class mapping.
-- Add `.mlmodel` mapping to extension detection.
+- Add scanner metadata entry.
+- Add `.mlmodel` mapping to descriptor-owned extension detection.
 - Ensure scanner priority is above generic manifest/text handling.
 
 1. Optional deep-validation path

{modelaudit-0.2.35 → modelaudit-0.2.37}/docs/maintainers/format-gap-plans/mxnet-models.md

@@ -55,8 +55,8 @@ Out of scope:
 1. Routing and integration
 
 - Register scanner with proper priority relative to manifest/text scanners.
-- Add extension mapping entries for selected MXNet artifacts.
-- Ensure lazy loader class mapping is added.
+- Add descriptor-owned extension mapping entries for selected MXNet artifacts.
+- Ensure lazy exports resolve from scanner metadata.
 
 1. Robustness
 

{modelaudit-0.2.35 → modelaudit-0.2.37}/docs/maintainers/format-gap-plans/torchserve-mar.md

@@ -31,8 +31,8 @@ Out of scope:
 ## Deliverables
 
 - `modelaudit/scanners/torchserve_mar_scanner.py`
-- Registry wiring in `modelaudit/scanners/__init__.py`
-- Extension detection updates in `modelaudit/utils/file/detection.py`
+- Registry metadata in `modelaudit/scanner_registry_metadata.py`
+- Descriptor-owned extension detection updates
 - Unit tests under `tests/scanners/test_torchserve_mar_scanner.py`
 - Fixture allowlist update in `tests/conftest.py`
 - User docs and changelog updates
@@ -84,8 +84,8 @@ Out of scope:
 1. Registry and routing
 
 - Add scanner registration entry with priority before generic ZIP scanner.
-- Add class mapping in `__getattr__`.
-- Add extension mapping for `.mar` in `EXTENSION_FORMAT_MAP`.
+- Ensure lazy exports resolve from scanner metadata.
+- Add extension mapping for `.mar` in `modelaudit/scanner_registry_metadata.py` `EXTENSION_FORMAT_MAP`.
 - Ensure fallback behavior keeps `.mar` from being treated as unknown.
 
 1. Performance and resilience

modelaudit-0.2.37/docs/maintainers/scanner-cve-gap-analysis-2026-04-11.md

@@ -0,0 +1,130 @@
+# Scanner CVE Gap Analysis
+
+Date: 2026-04-11
+
+Scope: inventory every registered scanner from `modelaudit/scanner_registry_metadata.py`, compare implemented CVE/security coverage against known public model-artifact vulnerability classes, and identify practical detection gaps.
+
+This is a static-analysis gap report, not a claim that every listed runtime CVE can be detected safely from a model file alone. Rules should only be implemented when a precise artifact-level invariant exists and benign near-matches can be tested.
+
+## Summary
+
+- Registered scanners: 39.
+- Strong CVE-specific coverage today: pickle/PyTorch/joblib, Keras ZIP/H5, ONNX external data, NumPy object arrays, skops, NeMo archive/checkpoint/Hydra issues, MXNet operator ReDoS, TorchServe MAR traversal, and Jinja/GGUF SSTI.
+- Strong generic coverage today: ZIP/TAR/7z/compressed archive traversal and bomb checks, secrets/URLs/metadata indicators, custom/native code references, external paths, and bounded parsing.
+- Remaining high-priority research gaps: LightGBM CVE-2024-43598 feasibility, GGUF/llama.cpp parser-CVE invariants, ExecuTorch binary loader-CVE invariants, and TensorFlow/TFLite malformed-model CVE feasibility. No detector should ship for these until public PoCs or advisories expose low-noise artifact-level invariants.
+
+## Scanner Inventory And Gap Matrix
+
+| Scanner               | Formats                                                                                                                   | Current security/CVE coverage                                                                                                                                                                                                                  | Public CVE/known-vulnerability watchlist                                                                                                                                                           | Gap assessment                                                                                                                                                                                                       |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pickle`              | `.pkl`, `.pickle`, `.dill`, `.bin`, `.pt`, `.pth`, `.ckpt`, `.joblib` via scanner-only routing                            | Unsafe globals/opcodes, suspicious imports, package-manager gadgets, nested pickle handling, `CVE-2020-13092`, `CVE-2025-1716`, `CVE-2025-32434`, `CVE-2026-24747`, PyTorch RPC pattern references                                             | Inherent RCE on untrusted pickle/joblib/cloudpickle/dill; picklescan bypasses `CVE-2025-1889`, `CVE-2025-1945`, `CVE-2025-10155`; analyzer bypasses in Fickling `CVE-2026-22606`, `CVE-2026-22607` | Mostly covered for model-file risk. Add regression fixtures for picklescan nonstandard extension and malformed ZIP bypass shapes if not already routed through core. Consider explicit runpy/cProfile payload tests. |
+| `pytorch_zip`         | `.pt`, `.pth`, `.ckpt`, `.pkl`, `.bin`                                                                                    | ZIP entry validation, symlinks, embedded pickle scan, PyTorch version metadata checks for `CVE-2025-32434`, `CVE-2026-24747`, `CVE-2022-45907`, `CVE-2024-5480`, `CVE-2024-48063`, tensor metadata validation for `CVE-2026-24747`             | PyTorch `torch.load`/`torch.jit.load` untrusted RCE; picklescan bypass CVEs for hidden or misrouted pickle payloads                                                                                | Strong. Add focused `CVE-2025-1889` / `CVE-2025-1945` archive-structure attribution if fixtures are not present.                                                                                                     |
+| `pytorch_binary`      | `.bin`                                                                                                                    | Static suspicious binary/string checks and routed pickle fallback                                                                                                                                                                              | PyTorch `.bin` may be pickle-disguised or tensor data; `CVE-2025-10155` covers PyTorch-extension bypass in picklescan                                                                              | Covered if core format detection routes protocol 0/1 pickles in `.bin`; keep regression coverage.                                                                                                                    |
+| `joblib`              | `.joblib`                                                                                                                 | Decompression plus pickle scan; `CVE-2020-13092`, `CVE-2024-34997`; CVE attribution helpers                                                                                                                                                    | Inherent joblib pickle RCE; sklearn/joblib persistence warns against untrusted loads                                                                                                               | Good. Keep doc/comment guards and benign sklearn fixtures to limit false positives.                                                                                                                                  |
+| `skops`               | `.skops`, ZIP-routed                                                                                                      | `CVE-2025-54412`, `CVE-2025-54413`, `CVE-2025-54886`, unsafe joblib fallback, path/traversal/bomb bounds                                                                                                                                       | skops < 0.12.0 RCE through trusted-type and MethodNode issues; Card fallback to joblib                                                                                                             | Covered for known skops CVEs. Future work: improve version extraction confidence if skops archive exposes reliable producer metadata.                                                                                |
+| `numpy`               | `.npy`, `.npz`                                                                                                            | Object dtype pickle recursion and `CVE-2019-6446` attribution; dtype/shape/size validation                                                                                                                                                     | `CVE-2019-6446` disputed but useful for object-array pickle RCE; `CVE-2021-33430` array construction DoS                                                                                           | RCE covered. DoS parser CVEs need artifact-level feasibility research before adding noisy checks.                                                                                                                    |
+| `tf_savedmodel`       | `.pb`, SavedModel directories                                                                                             | Suspicious TensorFlow ops/functions, external references, graph/protobuf checks, bounded parsing                                                                                                                                               | TensorFlow security policy treats untrusted graphs as code; malformed graph CVEs include `CVE-2022-23590`, `CVE-2022-23591`, `CVE-2022-23594`; `saved_model_cli` code injection `CVE-2022-29216`   | Generic unsafe-op coverage exists, but CVE-specific malformed-graph invariants are not attributed. Research whether these CVEs expose static proto patterns worth detecting.                                         |
+| `tf_metagraph`        | `.meta`                                                                                                                   | Unsafe op patterns, `PyFunc`, dynamic-library/external path style checks                                                                                                                                                                       | Same TensorFlow graph trust boundary and malformed graph CVEs                                                                                                                                      | Same as SavedModel; add CVE-specific attribution only when low-noise proto signals exist.                                                                                                                            |
+| `tflite`              | `.tflite`, `.bin`                                                                                                         | FlatBuffer traversal guardrails, subgraph/operator/tensor limits, custom operator warnings                                                                                                                                                     | TFLite parser/kernel CVEs including `CVE-2020-15211`, `CVE-2021-29601`, `CVE-2023-27579`                                                                                                           | Good generic bounds. Gap: no CVE-specific malformed-model checks; research whether public PoCs map to static operator/tensor invariants.                                                                             |
+| `keras_zip`           | `.keras`, ZIP-routed                                                                                                      | Lambda/custom objects, dangerous module references, `CVE-2024-3660`, `CVE-2025-1550`, `CVE-2025-8747`, `CVE-2025-9906`, `CVE-2025-49655`, `CVE-2025-12058`, `CVE-2025-12060`, embedded HDF5 `CVE-2026-1669`                                    | Keras safe_mode bypass family, `StringLookup` file/SSRF, `TorchModuleWrapper`, get_file gadget, get_file tar path traversal `CVE-2025-12060`                                                       | Covered for known Keras config CVEs with scoped false-positive guards.                                                                                                                                               |
+| `keras_h5`            | `.h5`, `.hdf5`, `.keras` HDF5                                                                                             | Lambda/custom-object checks, `CVE-2024-3660`, `CVE-2025-9905`, HDF5 external refs `CVE-2026-1669`                                                                                                                                              | H5 safe_mode ignored RCE; HDF5 external file read                                                                                                                                                  | Covered. Watch Keras affected-version drift; current code uses ranges that may need periodic advisory refresh.                                                                                                       |
+| `onnx`                | `.onnx`                                                                                                                   | Custom operator domains, integrity checks, external_data traversal `CVE-2022-25882`, nested bypass `CVE-2024-27318`, write traversal `CVE-2025-51480`, symlink traversal `CVE-2026-34447`                                                      | Helper/archive CVEs `CVE-2024-5187`; hub trust-warning bypass `CVE-2026-28500`                                                                                                                     | External-data path CVEs covered. Helper/hub CVEs are process-level unless model artifact encodes a dangerous URL/source.                                                                                             |
+| `openvino`            | `.xml`                                                                                                                    | Suspicious layers, Python/custom layers, external library/path references                                                                                                                                                                      | OpenVINO model loading and plugin extensibility; Model Server DoS `CVE-2023-31203`                                                                                                                 | Generic coverage only. No low-noise model-file CVE gap identified.                                                                                                                                                   |
+| `coreml`              | `.mlmodel`                                                                                                                | Custom layer/custom model blocks, custom parameters, linked-model path traversal/absolute path validation, bounded protobuf parsing                                                                                                            | No public CoreML model-loader CVE found in this pass; inherent risk from custom layers and third-party packages                                                                                    | Good generic coverage. Add `.mlpackage` support if product scope expands beyond `.mlmodel`.                                                                                                                          |
+| `executorch`          | `.ptl`, `.pte`                                                                                                            | Suspicious content and structural checks                                                                                                                                                                                                       | ExecuTorch loader heap-buffer-overflow CVEs `CVE-2025-30402`, `CVE-2025-54949`, `CVE-2025-54951`                                                                                                   | Research gap. Determine if public PoCs expose static `.pte` header/program-count/offset invariants.                                                                                                                  |
+| `gguf`                | `.gguf`, `.ggml`, `.ggmf`, `.ggjt`, `.ggla`, `.ggsa`                                                                      | Header/metadata/tensor count, dimensions, offsets, type/size consistency, bounds, alignment                                                                                                                                                    | llama.cpp/GGUF parser CVEs `CVE-2024-23496`, `CVE-2025-49847`, `CVE-2025-53630`; GGUF overflow advisory `GHSA-vgg9-87g3-85w8`                                                                      | Good generic bounds. Gap: map known llama.cpp CVEs/advisories to explicit malformed header/tensor metadata rules and tests.                                                                                          |
+| `llamafile`           | `.llamafile`, `.exe`, extensionless executable                                                                            | Executable wrapper checks and embedded GGUF payload analysis                                                                                                                                                                                   | Inherits llama.cpp/GGUF parser risks; executable artifact by design                                                                                                                                | Same GGUF gap plus executable provenance/signature policy if desired.                                                                                                                                                |
+| `jinja2_template`     | `.gguf`, `.json`, `.yaml`, `.yml`, `.jinja`, `.j2`, `.template`                                                           | SSTI patterns in templates and model metadata; `CVE-2024-34359` attribution                                                                                                                                                                    | llama-cpp-python GGUF chat-template SSTI `CVE-2024-34359`; Jinja sandbox escapes such as `CVE-2019-10906`, `CVE-2025-27516`                                                                        | Covers model-metadata SSTI class. Future rules should stay template-context specific to avoid flagging documentation.                                                                                                |
+| `flax_msgpack`        | `.msgpack`, `.flax`, `.orbax`, `.jax`                                                                                     | Msgpack structure/security object checks, metadata/reference indicators, bounds                                                                                                                                                                | No public Flax/JAX checkpoint CVE found in this pass; parser/DoS risk remains                                                                                                                      | Generic coverage appropriate. No CVE-specific gap identified.                                                                                                                                                        |
+| `jax_checkpoint`      | `.ckpt`, `.checkpoint`, `.orbax-checkpoint`, `.pickle`                                                                    | Multiple serialization variants; pickle/global checks where relevant                                                                                                                                                                           | JAX/Orbax checkpoints can wrap pickle or filesystem metadata; no public checkpoint CVE found                                                                                                       | Good generic coverage. Ensure pickle-backed checkpoint routes inherit PickleScanner CVEs.                                                                                                                            |
+| `r_serialized`        | `.rds`, `.rda`, `.rdata`                                                                                                  | Static string/payload indicators for unsafe R deserialization                                                                                                                                                                                  | R `readRDS` can recreate objects with executable hooks in some workflows; no specific model-artifact CVE found                                                                                     | Generic only. Consider targeted checks for path/network/system strings in serialized symbols, but avoid broad CVE claims.                                                                                            |
+| `paddle`              | `.pdmodel`, `.pdiparams`                                                                                                  | Static embedded code/string patterns                                                                                                                                                                                                           | Paddle security docs warn `paddle.load` uses pickle; framework RCE `CVE-2024-0917`                                                                                                                 | Gap: ensure `.pdiparams` pickle-like payloads route to pickle scanning where content permits; no `.pdmodel` CVE-specific rule identified.                                                                            |
+| `cntk`                | `.dnn`, `.cmf`                                                                                                            | Signature/string analysis for load-time execution indicators                                                                                                                                                                                   | No public CNTK model-file CVE found                                                                                                                                                                | Generic coverage only; acceptable unless new advisories appear.                                                                                                                                                      |
+| `torch7`              | `.t7`, `.th`, `.net`                                                                                                      | Legacy Torch/Lua execution and dynamic loading indicators                                                                                                                                                                                      | Legacy Lua serialization can reference executable code; no public model-file CVE found                                                                                                             | Generic coverage appropriate.                                                                                                                                                                                        |
+| `tensorrt`            | `.engine`, `.plan`, `.trt`                                                                                                | Suspicious strings, plugin entry point indicators                                                                                                                                                                                              | TensorRT plugins/custom ops are trust boundary; no public parser CVE found                                                                                                                         | Generic coverage only. Consider stronger plugin/library path attribution.                                                                                                                                            |
+| `rknn`                | `.rknn`                                                                                                                   | Metadata references, command/network indicators, bounded parsing                                                                                                                                                                               | RKNN custom op/converter risk; no public model-parser CVE found                                                                                                                                    | Generic coverage only.                                                                                                                                                                                               |
+| `mxnet`               | `*-symbol.json`, `*.params`                                                                                               | Custom/external operator references, embedded payloads, params integrity, `CVE-2022-24294` operator-name ReDoS detection                                                                                                                       | `CVE-2022-24294` regex DoS from crafted operator names                                                                                                                                             | Covered with a pathological-shape rule and benign long-name guard.                                                                                                                                                   |
+| `lightgbm`            | `.model`, `.txt`, `.lgb`, `.lightgbm`                                                                                     | Command/network/path/encoded payload indicators, native text/binary validation                                                                                                                                                                 | `CVE-2024-43598` heap buffer overflow with sparse public details                                                                                                                                   | Research-only gap until exploit preconditions are concrete. Avoid broad "long line" rule without PoC-derived invariant.                                                                                              |
+| `xgboost`             | `.bst`, `.model`, `.json`, `.ubj`                                                                                         | Format/config anomaly checks, suspicious references                                                                                                                                                                                            | No core XGBoost model-load CVE found; adjacent H2O XGBoost asset extraction CVEs are not core format                                                                                               | Generic coverage adequate.                                                                                                                                                                                           |
+| `catboost`            | `.cbm`                                                                                                                    | Native metadata parsing, suspicious markers, bounds                                                                                                                                                                                            | No public `.cbm` parser CVE found; package install-time archive CVEs are adjacent                                                                                                                  | Generic coverage adequate.                                                                                                                                                                                           |
+| `pmml`                | `.pmml`                                                                                                                   | XML security checks and suspicious content                                                                                                                                                                                                     | PMML/XML XXE/SSRF/DoS class; no PMML-specific CVE found                                                                                                                                            | Ensure XXE/entity expansion stays disabled and tested. No CVE-specific gap.                                                                                                                                          |
+| `nemo`                | `.nemo`                                                                                                                   | Tar/config analysis, archive traversal checks for `CVE-2025-23250` and `CVE-2025-23360`, checkpoint unsafe deserialization attribution for `CVE-2025-23249`, Hydra `_target_` injection `CVE-2025-23304`, dangerous/suspicious callable checks | Additional NVIDIA NeMo advisories include newer checkpoint-loading fixes such as `CVE-2025-33253` and `CVE-2026-24157`                                                                             | Covered for static archive-member traversal and malicious checkpoint payload signals. Keep watch for additional NeMo checkpoint CVEs that expose more precise non-pickle invariants.                                 |
+| `torchserve_mar`      | `.mar`                                                                                                                    | Entry count/size/ratio limits, path traversal with `CVE-2023-48299` attribution, symlink checks, handler static analysis, requirements/external reference checks, nested scan                                                                  | TorchServe `CVE-2023-48299` ZipSlip, `CVE-2023-43654` SSRF/model registration file write, `CVE-2024-35198` allowed_urls bypass, `CVE-2024-35199` exposed gRPC defaults                             | MAR ZipSlip covered. SSRF/default-port CVEs are deployment-level unless MAR manifests encode risky download URLs or config.                                                                                          |
+| `zip`                 | `.zip`, `.npz`, `.mar`                                                                                                    | Recursive scan, traversal, symlink, compression ratio, nested dispatch, MAR Python fallback                                                                                                                                                    | Zip Slip, symlink traversal, ZIP bomb CVEs across archive libraries                                                                                                                                | Generic coverage good. For `.mar`, delegate CVE attribution to TorchServe-specific scanner.                                                                                                                          |
+| `tar`                 | `.tar`, `.tar.gz`, `.tgz`, `.tar.bz2`, `.tbz2`, `.tar.xz`, `.txz`                                                         | Recursive scan, path traversal, symlink/hardlink safety, depth/size controls                                                                                                                                                                   | Tar traversal/symlink CVEs including Python tarfile class issues                                                                                                                                   | Generic coverage good. Consider CVE-specific tags only in product-specific contexts like NeMo/TorchServe/Keras `get_file`.                                                                                           |
+| `sevenzip`            | `.7z`                                                                                                                     | Recursive nested scan, entry/size/depth controls                                                                                                                                                                                               | 7-Zip traversal/extraction CVEs in loader libraries                                                                                                                                                | Generic coverage good. CVE-specific claims likely belong to extractors, not model artifacts.                                                                                                                         |
+| `compressed`          | `.gz`, `.bz2`, `.xz`, `.lz4`, `.zlib`                                                                                     | Safe bounded decompression, ratio/depth controls, inner scanner routing                                                                                                                                                                        | Decompression bombs and parser DoS                                                                                                                                                                 | Generic coverage good.                                                                                                                                                                                               |
+| `oci_layer`           | `.manifest`                                                                                                               | Manifest parsing, layer path traversal validation, embedded layer/model scanning                                                                                                                                                               | OCI artifact annotation/path traversal issues such as Docker Compose `CVE-2025-62725`; secret leakage via image/config metadata                                                                    | Generic path/embedded scan coverage exists. Gap: add annotation/env/secret-specific checks if OCI artifacts are common input.                                                                                        |
+| `manifest`            | `.json`, `.yaml`, `.yml`, `.xml`, `.toml`, `.ini`, `.cfg`, `.config`, `.manifest`, `.model`, `.metadata`, known filenames | Blacklisted names/terms, suspicious URLs, weak hashes, model config metadata                                                                                                                                                                   | Manifest injection, external URLs, poisoned metadata, dependency pinning issues                                                                                                                    | Generic coverage appropriate. No CVE-specific gap except where specific ecosystem scanners can claim context.                                                                                                        |
+| `metadata`            | docs/model cards                                                                                                          | Suspicious URLs/secrets/token-like content in docs                                                                                                                                                                                             | Metadata leakage and staged-download indicators                                                                                                                                                    | Generic coverage appropriate.                                                                                                                                                                                        |
+| `text`                | `.txt`, `.md`, `.markdown`, `.rst`                                                                                        | Low-signal text sanity and ML-related text scan                                                                                                                                                                                                | Same as metadata                                                                                                                                                                                   | Generic coverage appropriate.                                                                                                                                                                                        |
+| `safetensors`         | `.safetensors`                                                                                                            | Header size, JSON metadata, tensor offsets/bounds/overlap, path traversal-like metadata                                                                                                                                                        | No public safetensors core CVE found; oversized metadata/header DoS PoCs exist                                                                                                                     | Good generic bounds. Add regression corpus for oversized metadata and malformed offset overlap.                                                                                                                      |
+| `weight_distribution` | `.pt`, `.pth`, `.h5`, `.keras`, `.hdf5`, `.pb`, `.onnx`                                                                   | Statistical anomaly/backdoor-like weight distribution checks                                                                                                                                                                                   | No CVE class; maps to model backdoor/trojan detection                                                                                                                                              | Not a CVE scanner. Gap analysis should track model-integrity attacks separately from CVEs.                                                                                                                           |
+
+## Implemented CVE Coverage
+
+The codebase currently contains specific coverage or explanation/test references for:
+
+- Pickle/joblib/PyTorch family: `CVE-2020-13092`, `CVE-2024-34997`, `CVE-2025-1716`, `CVE-2025-32434`, `CVE-2026-24747`, `CVE-2022-45907`, `CVE-2024-5480`, `CVE-2024-48063`, `CVE-2025-10155`.
+- Keras: `CVE-2024-3660`, `CVE-2025-1550`, `CVE-2025-8747`, `CVE-2025-9905`, `CVE-2025-9906`, `CVE-2025-49655`, `CVE-2025-12058`, `CVE-2025-12060`, `CVE-2026-1669`.
+- ONNX: `CVE-2022-25882`, `CVE-2024-27318`, `CVE-2025-51480`, `CVE-2026-34447`.
+- MXNet: `CVE-2022-24294`.
+- TorchServe MAR: `CVE-2023-48299`.
+- NumPy: `CVE-2019-6446`.
+- NeMo: `CVE-2025-23249`, `CVE-2025-23250`, `CVE-2025-23304`, `CVE-2025-23360`.
+- Jinja/GGUF metadata: `CVE-2024-34359`.
+- skops: `CVE-2025-54412`, `CVE-2025-54413`, `CVE-2025-54886`.
+
+## Prioritized Backlog
+
+Implemented in the follow-up pass:
+
+- ONNX `CVE-2026-34447` symlink external-data traversal detection.
+  - Signal: external_data location resolves inside model dir but the target path is a symlink whose real path escapes the model directory.
+  - Test: malicious symlink fixture plus normal external data file negative.
+
+- TorchServe MAR ZipSlip attribution as `CVE-2023-48299`.
+  - Signal: existing MAR path traversal or absolute critical path member finding.
+  - Test: traversal member gets CVE details; harmless nested path stays clean.
+
+- MXNet `CVE-2022-24294` ReDoS operator-name rule.
+  - Signal: PoC-derived pathological operator name shape, not generic long names.
+  - Test: crafted symbol JSON positive and benign long/simple name negative.
+
+- Keras `CVE-2025-12060` attribution for `get_file(extract=True)` archive extraction.
+  - Signal: executable Keras config references `keras.utils.get_file` with remote tar/archive URL plus `extract=True`.
+  - Test: direct and kwargs positives; extract-disabled, non-archive URL, and metadata-only negatives.
+
+- NeMo archive and checkpoint CVE coverage.
+  - Signal: unsafe tar member paths/links and nested checkpoint payloads that existing pickle/PyTorch scanners classify as critical.
+  - Test: relative/absolute/symlink traversal positives, normalized safe path negative, malicious checkpoint positive, benign checkpoint negative.
+
+Remaining research backlog:
+
+1. Research LightGBM `CVE-2024-43598` static feasibility.
+   - Ship no detector until the exploit maps to a model-text/binary invariant.
+
+2. Map GGUF/llama.cpp parser advisories to concrete metadata rules.
+   - Candidate signals: overflow-prone tensor offset/size/alignment combinations, invalid type/count fields, wrapped cumulative tensor sizes.
+   - Avoid general "corrupt GGUF" CVE claims.
+
+3. Research ExecuTorch loader CVEs against `.pte` structure.
+   - Candidate signals: table counts, offsets, op/program sizes, or alignment values linked to public PoCs.
+
+4. TensorFlow/TFLite malformed-model CVE feasibility research.
+   - Existing bounds/custom-op checks are valuable; CVE-specific rules need PoC-derived invariants.
+
+## External Research Source Index
+
+The research pass reviewed public advisory records and vendor/project security notes from these source families. URLs are intentionally omitted here so documentation CI does not depend on third-party advisory-site availability.
+
+- Wiz vulnerability database entries for PyTorch `CVE-2025-32434` and MXNet `CVE-2022-24294`.
+- Debian Security Tracker entry for NumPy `CVE-2019-6446`.
+- NVD records for picklescan `CVE-2025-1889` and Keras `CVE-2025-12060`.
+- INCIBE vulnerability records for picklescan `CVE-2025-10155` and skops `CVE-2025-54413`.
+- GitHub advisory entry for Keras H5 `CVE-2025-9905`.
+- Public Keras HDF5 external-reference writeup for `CVE-2026-1669`.
+- Red Hat Bugzilla entry for ONNX `CVE-2026-34447`.
+- NVIDIA NeMo March and April 2025 security bulletins for `CVE-2025-23360`, `CVE-2025-23249`, `CVE-2025-23250`, and `CVE-2025-23251`.
+- Securitm vulnerability entry for Jinja/GGUF `CVE-2024-34359`.
+- TensorFlow, TorchServe, and OpenVINO project security-policy documentation.