File size: 2,222 Bytes
3342981 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 | ---
language: en
license: apache-2.0
tags:
- setfit
- sentence-transformers
- code-security
- vulnerability-detection
- sast
- spidercob
base_model: sentence-transformers/all-MiniLM-L6-v2
metrics:
- accuracy
model-index:
- name: code-risk-classifier
results:
- task:
type: text-classification
metrics:
- type: accuracy
value: 0.9809
---
# Code Risk Classifier
Fine-tuned [SetFit](https://github.com/huggingface/setfit) model for code security risk classification. Part of the [Spidercob](https://spidercob.com) DLP platform — reduces false positives in supply-chain and secret scanning.
## Model Description
Classifies code snippets into one of four risk categories:
| Label | Description |
|---|---|
| `REAL_SECRET` | Actual hardcoded credentials, API keys, or tokens |
| `VULNERABLE_LOGIC` | Code patterns associated with known CVEs or insecure practices |
| `TEST_MOCK` | Test fixtures, mock data, example credentials in test files |
| `SAFE_CODE` | Benign code with no security concerns |
**Base model:** `sentence-transformers/all-MiniLM-L6-v2`
**Framework:** SetFit (few-shot fine-tuning)
**Test accuracy:** 98.09%
## Usage
```python
from setfit import SetFitModel
model = SetFitModel.from_pretrained("Sumeetgpt/code-risk-classifier")
predictions = model.predict([
'API_KEY = "sk-prod-abc123real"',
'API_KEY = "test_placeholder_key"',
])
print(predictions) # ['REAL_SECRET', 'TEST_MOCK']
```
## Intended Use
Used inside the Spidercob supply-chain scanner to filter CVE findings and secret detections. Prevents alert fatigue from test fixtures and example configs while surfacing genuine security risks.
## Training Data
Trained on examples from:
- WebGoat (vulnerable Java web application)
- DVWA (Damn Vulnerable Web Application)
- truffleHog secret detection corpus
- factory_boy, faker, pytest fixtures
- Django, FastAPI secure coding examples
## Limitations
- Optimized for short code snippets (single lines to a few lines of context)
- Works best with Python, JavaScript, Java — limited training on other languages
- Not a standalone SAST tool — designed as a downstream classifier for pattern-matched findings
|