# Security

## Reporting a vulnerability

Open a discussion on the [model repository](https://huggingface.co/Dexy2/Piko-9b/discussions) or
an issue at [github.com/itsdexy/Piko-9b](https://github.com/itsdexy/Piko-9b/issues).

For anything involving leaked credentials or user data, please use a **private** channel first
rather than a public issue.

## Scope

In scope:

* Secrets, tokens, or personal data present in the repository or in the weights
* Malicious content in the checkpoint (see below)
* Vulnerabilities in the scripts published here
* Licence or attribution errors that create legal exposure for users

Out of scope:

* The model generating incorrect, biased, or offensive text. That is a capability limitation, not
  a vulnerability — see the Limitations section of the model card.
* Jailbreaks that make the model produce content it would otherwise decline. Alignment for this
  checkpoint is inherited from upstream and was never specifically trained; the custom suite
  measures it at 7/10 on a 10-prompt probe. Treat it as weak by default.

## Checkpoint integrity

* All weights are `safetensors`, which cannot execute code on load, unlike pickled `.bin` files.
* The repository contains **no Python files** and **no `auto_map`** in `config.json`, so
  `trust_remote_code=True` is not required. If any tool asks you to enable it for this model,
  treat that as suspicious.
* `scripts/audit_repository.py` scans the checkpoint for tokens, keys, private-key blocks, and
  absolute local paths. Run it after any change:

  ```bash
  python scripts/audit_repository.py --model <path> --output reports/repository_audit.json
  ```

## Known hygiene issue in the original release

The `config.json` published with the initial release contained a `piko_composition` block with two
absolute filesystem paths from the author's machine (`<workspace>/...`). No credentials
were exposed, but the paths revealed a local directory layout and a private project name. The
corrected block carries source identifiers instead. `tests/test_model_loading.py` contains a
regression test that fails if any local path reappears in `config.json`.

## Running model-generated code

`evaluation/custom_suite/run_custom_eval.py` executes code the model produces, in a subprocess
with a 20-second timeout. **This is not a sandbox.** Do not point that suite at untrusted models
or untrusted prompts on a machine you care about. Use a container or a disposable VM.

## Prompt injection

Piko-9b has no specific defence against instructions embedded in the content it is given. This
matters most in the use case the model is best at: reading documents. A scanned invoice containing
the text *"ignore previous instructions and…"* is input the model may follow.

If you build a document pipeline on this model:

* Treat every model output as untrusted data, never as commands.
* Do not let extracted content drive tool calls, shell commands, or database writes unvalidated.
* Validate structured output against a schema before use.

The suite's `sf-04` case checks one simple jailbreak string and passes; that is a smoke test, not
an assurance.

## Supported versions

Only the current published revision of `Dexy2/Piko-9b` is maintained. Pin a revision in production:

```python
AutoModelForMultimodalLM.from_pretrained("Dexy2/Piko-9b", revision="<commit-sha>")
```