Skip to content

DOC Add section on security of supported libraries #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
E-Aho merged 1 commit into from
Jan 5, 2023
Merged

DOC Add section on security of supported libraries #261

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/persistence.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,11 @@ there is a bug in skops. Please open an issue on `our issue tracker
<https://github.com/skops-dev/skops/issues>`__ (but please check first if a
corresponding issue already exists).

In terms of security, we do not audit these libraries for security issues.
Therefore, you should only load a skops file containing a model of any of those
libraries if you trust them to be secure. It's not a perfect solution, but it's
still better than trusting pickle files, which anyone can tamper with easily.

Roadmap
-------
There needs to be more testing to harden the loader and make sure we don't run
Expand Down