SECURITY.md

Security policy

Custom model code

Unlimited-OCR requires custom Python. This project never follows a floating model revision during inference.

prepare:

1. downloads one pinned Baidu revision into a unique partial directory under a preparation lock;
2. fully hashes every expected code, configuration, tokenizer, index, license, and weight file;
3. applies exact, count-checked source transformations;
4. verifies the patched tree, rejects symlinks and unexpected files, and records an exact local manifest;
5. publishes the completed directory only after all checks pass.

run uses only the prepared local directory with local_files_only=True, HF_HUB_OFFLINE=1, and TRANSFORMERS_OFFLINE=1. Those settings prevent model resolution from using the network; they are not a process sandbox.

Untrusted documents

Model output is untrusted Markdown/raw HTML data. The runtime does not call eval() on it. Output paths use an exclusive, random same-directory temporary file and an atomic no-replace publish; symlinks and input/output aliases are rejected. --force alone enables atomic replacement.

Images and PDFs can still trigger bugs in Pillow, PDFium/pypdfium2, PyTorch, Transformers, or the model code. PDF rendering has per-page and aggregate pixel/byte limits, but hostile inputs still belong under a dedicated unprivileged account or an appropriately restricted container. Do not expose this CLI directly as a public upload service without process/network sandboxing, input-byte limits, timeouts, and admission controls.

Reporting

Please report vulnerabilities privately through GitHub's security-advisory interface for this repository. Do not include private documents, credentials, model-cache tokens, or sensitive OCR output in a report.