← AI inventory

Hugging Face

Code · GitHub (demo) Hugging Face · Model hub · package: sentence-transformers · package: transformers · package: huggingface-hub

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
31
Medium
People
0
Committers are not collected
Repositories
2
1 public · 3 packages
Keys in code
0
None found in the files read
source-codefixturecorroborated
Next steps

Recommended actions

  1. 01Hugging Face SDKs appear in 2 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.
GitHub (demo) · fixture

Where it lives in code

SDK packages · 3
Repositories
RepositorySignalsPushed
contoso/data-pipelineSDK packages3 d ago
contoso/research-notebookspublicSDK packages12 d ago
Packages
sentence-transformers pypi1 repo
transformers pypi1 repo
huggingface-hub pypi1 repo
Same app, other lanes

Related findings

Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

No people are linked to this app.

Why

Evidence

  1. source_code · Sep 11, 2026
    Hugging Face in 2 repositories via GitHub (demo): packages sentence-transformers, transformers, huggingface-hub
    Detail
    {
  "repos": [
    "contoso/data-pipeline",
    "contoso/research-notebooks"
  ],
  "configs": [],
  "packages": [
    {
      "name": "sentence-transformers",
      "repos": 1,
      "ecosystem": "pypi"
    },
    {
      "name": "transformers",
      "repos": 1,
      "ecosystem": "pypi"
    },
    {
      "name": "huggingface-hub",
      "repos": 1,
      "ecosystem": "pypi"
    }
  ],
  "endpoints": []
}
  2. corroboration
    Also found by another lane (mde:huggingface)
    Detail
    {
  "findingKey": "mde:huggingface"
}
  3. corroboration
    Also found by another lane (siem:P3xsUoa63aFWUE_YRNuUJ:huggingface)
    Detail
    {
  "findingKey": "siem:P3xsUoa63aFWUE_YRNuUJ:huggingface"
}