Reporting a vulnerability

[nirajmodi19]

Describe the bug

Hello!

I hope you are doing well!

I am a security researcher and a bug bounty hunter . I detected a vulnerability in this repository. I want to disclose it responsibly, I got to know that huggingface have an active private bug bounty program running on Hackerone.

I found different vulns in multiple repository and would love to report it responsibly.

Can you send me the invite, so that I can report it there? Or you can propose other preferable channel if needed.

My Hackerone username : jordin19

Reproduction

NA

Logs

System Info

NA

Who can help?

No response

[Michellehbn]

Hi @nirajmodi19! Could you please let me know to which asset the vulnerability is related? We recommend submitting open source vulnerabilities to https://huntr.com. And if it's a report for https://huggingface.co, we'll be sure to invite you to our private program with HackerOne. Thanks!

[nirajmodi19]

Hi @Michellehbn !

Thanks for your reply. I found vulberabilities on

https://github.com/huggingface/trl
https://github.com/huggingface/diffusers
https://github.com/huggingface/open-r1

[Michellehbn]

Hi @nirajmodi19! In that case you can submit reports to https://huntr.com/. If there's any other questions you can feel free to email us at security@huggingface.co.