SECURITY.md

# Security policy

## Custom model code

Unlimited-OCR requires custom Python. This project never follows a floating model revision during inference.

`prepare`:

1. downloads one pinned Baidu revision into a unique partial directory under a preparation lock;
2. fully hashes every expected code, configuration, tokenizer, index, license, and weight file;
3. applies exact, count-checked source transformations;
4. verifies the patched tree, rejects symlinks and unexpected files, and records an exact local manifest;
5. publishes the completed directory only after all checks pass.

`run` uses only the prepared local directory with `local_files_only=True`, `HF_HUB_OFFLINE=1`, and
`TRANSFORMERS_OFFLINE=1`. Those settings prevent model resolution from using the network; they are not a process sandbox.

## Untrusted documents

Model output is untrusted Markdown/raw HTML data. The runtime does not call `eval()` on it. Output paths use an exclusive,
random same-directory temporary file and an atomic no-replace publish; symlinks and input/output aliases are rejected.
`--force` alone enables atomic replacement.

Images and PDFs can still trigger bugs in Pillow, PDFium/pypdfium2, PyTorch, Transformers, or the model code. PDF rendering
has per-page and aggregate pixel/byte limits, but hostile inputs still belong under a dedicated unprivileged account or
an appropriately restricted container. Do not expose this CLI directly as a public upload service without process/network
sandboxing, input-byte limits, timeouts, and admission controls.

## Reporting

Please report vulnerabilities privately through GitHub's security-advisory interface for this repository. Do not include
private documents, credentials, model-cache tokens, or sensitive OCR output in a report.