HuggingFace publishes security.txt responsible disclosure page

Tue, 15 Sep 2026 15:32:56 +0000

Engineer — Learn: If your team uses HuggingFace for model hosting or inference, this is now the confirmed channel for reporting security issues; also a low-effort reminder to verify your own services expose a security.txt per RFC 9116.
SOC/IR — Skip
Leader — Skip

Vulnerability-Reporting on CuraSec