Add model card with description, usage examples, and training data details

README.md

@@ -1,130 +1,136 @@
 ---
+language: en
+license: apache-2.0
 tags:
-- setfit
-- sentence-transformers
-- text-classification
-- generated_from_setfit_trainer
-widget: []
-metrics:
-- accuracy
+  - setfit
+  - text-classification
+  - code-security
+  - secret-detection
+  - vulnerability-detection
+  - false-positive-reduction
+  - sast
+  - dlp
 pipeline_tag: text-classification
 library_name: setfit
-inference: true
+metrics:
+  - accuracy
+model-index:
+- name: spidercob/code-risk-classifier
+  results:
+  - task:
+      type: text-classification
+      name: Text Classification
+    dataset:
+      name: Public repos (WebGoat, DVWA, factory_boy, Django, FastAPI, truffleHog)
+      type: mixed
+      split: test
+    metrics:
+    - type: accuracy
+      value: 0.9942
+      name: Accuracy
 ---
 
-# SetFit
+# spidercob/code-risk-classifier
 
-This is a [SetFit](https://github.com/huggingface/setfit) model that can be used for Text Classification. A [LogisticRegression](https://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LogisticRegression.html) instance is used for classification.
+A [SetFit](https://github.com/huggingface/setfit) model that classifies **code security findings** — distinguishing real secrets and vulnerabilities from test fixtures and safe code.
 
-The model has been trained using an efficient few-shot learning technique that involves:
+## The Problem
 
-1. Fine-tuning a [Sentence Transformer](https://www.sbert.net) with contrastive learning.
-2. Training a classification head with features from the fine-tuned Sentence Transformer.
+Static analysis tools (SAST, secret scanners) generate high false-positive rates:
 
-## Model Details
+- A `SECRET_KEY = 'testing.'` in Django's test suite is not a real secret
+- A `$_GET['id']` in DVWA is an intentional vulnerability example, not production code
+- `factory_boy` password fields are test fixtures, not real credentials
+- A `bcrypt.hashpw()` call is safe, not a credential leak
+
+This model reads the code context and decides whether a finding is actionable.
 
-### Model Description
-- **Model Type:** SetFit
-<!-- - **Sentence Transformer:** [Unknown](https://huggingface.co/unknown) -->
-- **Classification head:** a [LogisticRegression](https://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LogisticRegression.html) instance
-- **Maximum Sequence Length:** 256 tokens
-- **Number of Classes:** 4 classes
-<!-- - **Training Dataset:** [Unknown](https://huggingface.co/datasets/unknown) -->
-<!-- - **Language:** Unknown -->
-<!-- - **License:** Unknown -->
+## Labels
 
-### Model Sources
+| Label | Description | Action |
+|---|---|---|
+| `REAL_SECRET` | Genuine hardcoded credential, API key, or private key | BLOCK |
+| `VULNERABLE_LOGIC` | Exploitable code pattern (SQLi, RCE, XSS, etc.) | BLOCK |
+| `TEST_MOCK` | Test fixture, dummy value, or mock data | ALLOW |
+| `SAFE_CODE` | Clean production code or secure implementation | ALLOW |
 
-- **Repository:** [SetFit on GitHub](https://github.com/huggingface/setfit)
-- **Paper:** [Efficient Few-Shot Learning Without Prompts](https://arxiv.org/abs/2209.11055)
-- **Blogpost:** [SetFit: Efficient Few-Shot Learning Without Prompts](https://huggingface.co/blog/setfit)
+## Quick Start
 
-## Uses
+```python
+from setfit import SetFitModel
 
-### Direct Use for Inference
+model = SetFitModel.from_pretrained("spidercob/code-risk-classifier")
 
-First install the SetFit library:
+examples = [
+    "Analyze this hardcoded_secret: AWS_ACCESS_KEY_ID=AKIA4REALKEY123ABC committed to main branch .env file",
+    "Analyze this vulnerable_pattern: $query = 'SELECT * FROM users WHERE id=' . $_GET['id'];",
+    "Analyze this test_fixture: factory_boy default: user.password = 'testpass123' for pytest fixtures",
+    "Analyze this clean_code: def get_user(db, user_id): return db.query(User).filter(User.id == user_id).first()",
+]
 
-```bash
-pip install setfit
+predictions = model.predict(examples)
+# ['REAL_SECRET', 'VULNERABLE_LOGIC', 'TEST_MOCK', 'SAFE_CODE']
 ```
 
-Then you can load this model and run inference.
+## Input Format
 
-```python
-from setfit import SetFitModel
-
-# Download from the 🤗 Hub
-model = SetFitModel.from_pretrained("setfit_model_id")
-# Run inference
-preds = model("I loved the spiderman movie!")
+```
+Analyze this {issue_type}: {code_snippet}
 ```
 
-<!--
-### Downstream Use
+- `issue_type`: the scanner finding type — e.g. `hardcoded_secret`, `vulnerable_pattern`, `sql_injection`, `test_fixture`, `clean_code`
+- `code_snippet`: the code context around the finding, up to ~400 characters
 
-*List how someone could finetune this model on their own dataset.*
--->
+## Integration Pattern
 
-<!--
-### Out-of-Scope Use
+```python
+from setfit import SetFitModel
 
-*List how the model may foreseeably be misused and address what users ought not to do with the model.*
--->
+model = SetFitModel.from_pretrained("spidercob/code-risk-classifier")
 
-<!--
-## Bias, Risks and Limitations
+def assess_finding(issue_type: str, code_snippet: str) -> dict:
+    text = f"Analyze this {issue_type}: {code_snippet}"
+    label = model.predict([text])[0]
+    probs = model.predict_proba([text])[0]
+    conf = max(probs)
 
-*What are the known or foreseeable issues stemming from this model? You could also flag here known failure cases or weaknesses of the model.*
--->
+    if label in ("REAL_SECRET", "VULNERABLE_LOGIC"):
+        return {"action": "BLOCK", "label": label, "confidence": conf}
+    else:
+        return {"action": "ALLOW", "label": label, "confidence": conf}
 
-<!--
-### Recommendations
+# Example
+result = assess_finding("hardcoded_secret", "SECRET_KEY = '0123456789ABCDEF' in production settings.py")
+# {"action": "BLOCK", "label": "REAL_SECRET", "confidence": 0.83}
+```
 
-*What are recommendations with respect to the foreseeable issues? For example, filtering explicit content.*
--->
+## Model Details
 
-## Training Details
+- **Base model**: `sentence-transformers/all-MiniLM-L6-v2`
+- **Method**: SetFit — contrastive fine-tuning + logistic regression head
+- **Test accuracy**: **99.4%**
+- **Classes**: 4 (REAL_SECRET, VULNERABLE_LOGIC, TEST_MOCK, SAFE_CODE)
 
-### Framework Versions
-- Python: 3.12.12
-- SetFit: 1.1.3
-- Sentence Transformers: 5.2.2
-- Transformers: 4.57.6
-- PyTorch: 2.10.0
-- Datasets: 5.0.0
-- Tokenizers: 0.22.2
+## Training Data
 
-## Citation
+~860 examples from 15 public repos (capped at 300 per class):
 
-### BibTeX
-```bibtex
-@article{https://doi.org/10.48550/arxiv.2209.11055,
-    doi = {10.48550/ARXIV.2209.11055},
-    url = {https://arxiv.org/abs/2209.11055},
-    author = {Tunstall, Lewis and Reimers, Nils and Jo, Unso Eun Seo and Bates, Luke and Korat, Daniel and Wasserblat, Moshe and Pereg, Oren},
-    keywords = {Computation and Language (cs.CL), FOS: Computer and information sciences, FOS: Computer and information sciences},
-    title = {Efficient Few-Shot Learning Without Prompts},
-    publisher = {arXiv},
-    year = {2022},
-    copyright = {Creative Commons Attribution 4.0 International}
-}
-```
+| Source | Label | Why |
+|---|---|---|
+| OWASP WebGoat, DVWA, NodeGoat | `VULNERABLE_LOGIC` | Intentionally vulnerable apps |
+| vulhub, DVGA | `VULNERABLE_LOGIC` | CVE docker environments |
+| truffleHog test corpus | `REAL_SECRET` | Confirmed leaked secrets |
+| factory_boy, Faker, pytest, model_bakery | `TEST_MOCK` | Test fixture libraries |
+| Django, FastAPI, Flask, requests, httpx | `SAFE_CODE` | Clean production frameworks |
 
-<!--
-## Glossary
+## Related Model
 
-*Clearly define terms in order to be accessible across audiences.*
--->
+For DLP regex false-positive reduction (SSNs, credit cards, emails, API keys in content), see [spidercob/dlp-intent-classifier](https://huggingface.co/spidercob/dlp-intent-classifier).
 
-<!--
-## Model Card Authors
+## About
 
-*Lists the people who create the model card, providing recognition and accountability for the detailed work that goes into its construction.*
--->
+Built by [Spidercob](https://spidercob.com) — enterprise DLP SaaS. This model powers the false-positive reduction layer in Spidercob's code security scanner.
 
-<!--
-## Model Card Contact
+## License
 
-*Provides a way for people who have updates to the Model Card, suggestions, or questions, to contact the Model Card authors.*
--->
+Apache 2.0