Security Protocols

1. Curation Integrity Verification

Every model entry database file (`data/models/*.json`) undergoes automated validation before merging:

• Zod Schema Enforcement: Strict type constraints verify parameters, context lengths, enums, dates, and modailties.
• Dual-Check Sourcing: Benchmarks and release details must reference at least one verified primary source (arXiv papers, official repositories, or official blogs).
• Verification Flagging: Any parameters or benchmarks that cannot be verified against primary sources are flagged with `verified: false` and accompanied by detailed Curator notes.

2. Infrastructure & Build Security

We secure our codebase and deployment architecture against standard web vectors:

• Static Site Generation (SSG): Modelverse builds pages statically, minimizing server-side attack vectors and removing database query vulnerability risks.
• Dependency Auditing: Automated tools continuously scan our npm modules for vulnerabilities, applying updates immediately when patches are available.
• No Execution Space: Modelverse does not run user-uploaded scripts or evaluate arbitrary user-provided code, protecting client sessions from cross-site scripting (XSS).

3. Open-Source Software and Weights Policy

For models marked `open-weights` or `open-source`, we link only to verified Hugging Face hubs, official GitHub repositories, or official developer portals.

Modelverse does not host model weights on its own servers, preventing download spoofing. We always encourage users to check official weight SHA-256 hashes before loading binaries locally.

4. Vulnerability Disclosure Policy

If you discover a security vulnerability in Modelverse or find a spoofed resource entry in our catalog, please notify us immediately.