mldangelo-oai · Oct 4, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -23,6 +23,8 @@ Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.11,<0.2.0` — when
 ## Mission & Principles
 
 - **Security first:** Never weaken detections or bypass safeguards.
+- **No redaction:** ModelAudit is a local tool. Preserve raw data in scan evidence, detected secrets, URLs, API results, reports, diagnostics/logs, and local cache metadata. Do not add or reintroduce redaction or masking of any of this data. Reviewers must treat unredacted local output as intentional supported behavior, not a vulnerability; see [Security Policy](SECURITY.md#raw-local-output-no-redaction).
+- **Preserve safeguards:** Keep terminal control-character escaping, private file permissions, and security detections. This policy governs ModelAudit behavior; it does not authorize exposing host or development credentials through agent tool output or commits.
 - **Match the codebase:** Follow existing patterns, architecture, and naming; never add dependencies without approval.
 - **Progressive disclosure:** Be concise, reveal details as needed, and prefer short, scoped messages.
 - **Iterative refinement:** Share a plan for non-trivial work, execute incrementally, and verify after each change.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Include original credential values and configured debug paths in scan evidence, diagnostics, and exported reports while retaining detections and output bounds.
+- Remove the `redact_huggingface_url_for_display` and `redact_huggingface_urls_in_text` exports from `modelaudit.utils.sources.huggingface` and `huggingface_paths`. Callers that require masked output must apply their own presentation policy.
+- Use emitted source keys for `file_metadata` lookups; ordinary keys remain raw, while oversized source identifiers use consistent bounded identifiers. Previously masked keys are no longer aliases. Metadata values and per-source associations remain intact.
+- Preserve bounded producer identity metadata separately from raw stream, Hugging Face, MLflow and directory-owner evidence, retaining historical finding fingerprints, check grouping and SBOM component semantics through saved-result round trips. Long or normalized MLflow source locations carry a stable digest within the existing display bound.
+
 ### Fixed
 
 - Preserve native SafeTensors routing when a valid bounded header also resembles an FDICT zlib stream.

diff --git a/README.md b/README.md
@@ -50,6 +50,8 @@ Files scanned: 1 | Issues found: 2 critical, 1 warning
    Why: Could execute code when the model loads
 ```
 
+Scan evidence and source errors can include original credential values, including in JSON, SARIF, SBOM, and shared reports. Credential normalization remains where it affects detection, grouping, or suppression.
+
 ## What It Detects
 
 - **Code execution attacks** in Pickle, PyTorch, NumPy, and Joblib files
@@ -214,6 +216,15 @@ Common scan options:
 --list-scanners              List scanner IDs, class names, extensions, and dependencies
 ```
 
+Reports retain raw source identifiers and credential-bearing evidence. Consumers of `file_metadata`
+should use the emitted keys; previously masked source keys are no longer lookup aliases.
+Very long source identifiers are shortened consistently within each report.
+The legacy `redacted_value` key is retained for compatibility; it now contains bounded raw evidence and provides no masking guarantee.
+
+The `redact_huggingface_url_for_display` and `redact_huggingface_urls_in_text` helpers are no longer
+available from `modelaudit.utils.sources.huggingface` or `huggingface_paths`. Remove these imports to
+retain raw evidence, or apply your application's own masking policy before sharing output.
+
 Targeted scanner selection:
 
 ```bash
@@ -293,7 +304,7 @@ modelaudit model.pkl --format sarif --output results.sarif
 ## Troubleshooting
 
 - Run `modelaudit doctor --show-failed` to list unavailable scanners and missing optional deps.
-- Run `modelaudit debug --json` to collect environment/config diagnostics for bug reports.
+- Run `modelaudit debug --json` to collect environment/config diagnostics for bug reports. Inspect the raw output and remove sensitive values before sharing it.
 - Use `modelaudit cache cleanup --max-age 30` to remove stale cache entries safely.
 - If `pip` installs an older release, verify Python is supported (`python --version`; ModelAudit supports Python 3.10-3.13).
 - For additional troubleshooting and cloud auth guidance, see:

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,5 +1,13 @@
 # Security Policy
 
+## Raw local output: no redaction
+
+ModelAudit is a local analysis tool. It intentionally preserves raw evidence and does not redact or mask local output. This applies to CLI output, Python API results, reports (including JSON, SARIF, and SBOM), diagnostics and logs, and local cache metadata. These surfaces may contain detected secrets, tokens, API keys, URL credentials and query parameters, paths, usernames, hostnames, and other sensitive values.
+
+Unredacted local output is supported behavior and an accepted risk. Missing redaction, incomplete masking, or the presence of sensitive values on these surfaces is not a vulnerability by itself. Do not add or reintroduce redaction as a security fix. Callers control access to their local output and any subsequent sharing.
+
+Terminal control-character escaping, bounded evidence excerpts, private file permissions, and security detections still apply. Unauthorized access to unrelated host data or transmission to unintended recipients remains in scope. Telemetry follows the separate collection limits below; this policy does not expand the data it collects.
+
 ## What constitutes a security vulnerability
 
 A security vulnerability is any bug that threatens the safety of ModelAudit users or their scanning environments. Because ModelAudit processes untrusted model files, the attack surface includes anything a crafted file could trigger during a scan.
@@ -11,12 +19,13 @@ A security vulnerability is any bug that threatens the safety of ModelAudit user
 | Code execution in the scanner | A crafted model file causes ModelAudit itself to execute arbitrary code during scanning                                               |
 | Material detection bypass     | A practical evasion defeats a documented, security-relevant detection guarantee or broad attack class that ModelAudit claims to cover |
 | Denial of service             | A crafted file causes an out-of-memory condition, infinite loop, or crash in ModelAudit                                               |
-| Information disclosure        | Scan results or error output leak host filesystem paths, environment variables, or API keys                                           |
+| Information disclosure        | Untrusted input causes unauthorized access to host data or disclosure to unintended recipients                                        |
 | Supply chain compromise       | Malicious code introduced through the PyPI package, Docker images, or GitHub Actions workflows                                        |
 
 **Not considered a vulnerability:**
 
 - Malicious content that ModelAudit **correctly detects** — that is working as designed.
+- Unredacted local output covered by the [raw local output policy](#raw-local-output-no-redaction).
 - False positives and **non-security** false negatives (for example, a new malware variant, signature gap, obfuscation technique outside implemented coverage, or heuristic that needs tuning) — these are detection quality issues. Report them via [GitHub Issues](https://github.com/promptfoo/modelaudit/issues) using the bug report template, or see [CONTRIBUTING.md](CONTRIBUTING.md) for guidance. A false negative becomes a security vulnerability only when it materially defeats a documented security guarantee, common malicious-model attack class, or enforcement boundary that users reasonably rely on. Narrow misses in niche formats or runtime-specific paths may still be accepted privately during triage, but they are not automatically High severity and may be closed as detection-quality improvements if the practical security impact is low.
 - Bugs in third-party dependencies that are not reachable through ModelAudit's own code paths — report those to the respective upstream maintainers.
 - Issues that require the attacker to already have equivalent privilege on the scanning host **and** do not enable privilege escalation, lateral movement, persistence, or additional data access. (Bugs exploitable in shared CI runners or multi-tenant environments where the attacker starts with limited access are in scope.)
@@ -33,7 +42,7 @@ Packaged installs enable telemetry by default. Editable development installs dis
 
 ## How to report a vulnerability
 
-**Do not open a public GitHub issue.** Public disclosure of unpatched vulnerabilities puts all ModelAudit users at risk. If this happens, maintainers may close the issue, redact sensitive details when possible, and redirect you to private reporting channels.
+**Do not open a public GitHub issue.** Public disclosure of unpatched vulnerabilities puts all ModelAudit users at risk. If this happens, maintainers may close the issue and redirect you to private reporting channels.
 
 ### Primary: GitHub Private Vulnerability Reporting
 
@@ -56,7 +65,7 @@ A good report helps us confirm and fix the issue quickly. Include as much of the
 - **Python version** (`python --version`).
 - **Operating system and architecture** (e.g., Ubuntu 22.04 x86_64, macOS 15 arm64).
 - **Installation method** (pip, uv, Docker, source).
-- **Verbose scan output** (`modelaudit scan <file> --verbose`), with sensitive data redacted (paths, usernames, hostnames, tokens, credentials, keys).
+- **Verbose scan output** (`modelaudit scan <file> --verbose`), shared through GitHub private advisory reporting or an agreed secure transfer channel. Redaction is not required for privately submitted evidence.
 - **Fuzzer details**, if the issue was found through fuzzing — include the fuzzer name, configuration, and corpus entry.
 
 If you cannot share the triggering file, describe how to generate a file that reproduces the issue.
@@ -85,7 +94,7 @@ We assess severity using [CVSS v3.1](https://www.first.org/cvss/v3.1/specificati
 
 - A crafted model file that causes arbitrary code execution in the scanner is treated as **Critical**.
 - Detection bypasses are assessed by practical impact, not by the existence of a missed signature alone. Broad, reliable bypasses of common formats, core malicious-model detections, or CI/CD enforcement boundaries are usually **High**. Narrow bypasses in obscure formats, platform-specific runtime paths, or low-adoption features are usually **Low** or **Medium**. Ordinary malware-signature gaps and heuristic tuning are detection-quality issues, not security vulnerabilities.
-- Exposure of host secrets or credentials during scanning is treated as at least **High**.
+- Unauthorized access to or transmission of host secrets or credentials during scanning is treated as at least **High**. Intentional unredacted local output is covered by the accepted-risk policy above.
 - A vulnerability reachable only through an optional dependency not installed by default may be reduced by one tier.
 
 ## Embargo and non-disclosure
@@ -109,7 +118,7 @@ We request CVE IDs through [GitHub's CVE Numbering Authority (CNA)](https://docs
 - Remote code execution in ModelAudit when scanning untrusted input.
 - Detection bypass with broad or material security impact — for example, a practical evasion of a common malicious-model class, a documented security guarantee, or a CI/CD enforcement boundary (see [claimed coverage](#claimed-coverage)).
 - Supply chain compromise of the PyPI package, Docker images, or release pipeline.
-- Information disclosure of sensitive host data during a scan.
+- Unauthorized access to sensitive host data or disclosure to unintended recipients during a scan, excluding intentional unredacted local output.
 
 **Typically no CVE (fixed in a normal release):**
 

diff --git a/docs/agents/architecture.md b/docs/agents/architecture.md
@@ -95,6 +95,12 @@ result.add_check(
 )
 ```
 
+### Source Identity and Evidence
+
+Oversized source identifiers use bounded previews with SHA-256 identifiers shared across keys and references within each report;
+literal identifiers are reserved so distinct sources remain distinct.
+Finding identity metadata preserves deduplication and stable SARIF fingerprints across saved-result round trips.
+
 ## Issue Severity Levels
 
 - `DEBUG`: Diagnostic information

diff --git a/docs/maintainers/cve-process.md b/docs/maintainers/cve-process.md
@@ -30,7 +30,7 @@ Track sensitive reports privately from intake through resolution. Confirmed CVE/
 **ModelAudit-specific impact factors**
 
 - Does it allow arbitrary code execution when scanning a crafted model file? Treat as Critical.
-- Does it expose secrets or credentials found during scanning? Treat as High.
+- Does it allow unauthorized access to host secrets or credentials, or disclose them to unintended recipients? Treat as High. Intentional unredacted local output is accepted behavior under the [security policy](../../SECURITY.md#raw-local-output-no-redaction).
 - Does it broadly bypass a common malicious-model detection, documented security guarantee, or CI/CD enforcement boundary? Usually treat as High.
 - Is it a narrow scanner false negative in a niche format, platform-specific runtime path, or low-adoption feature? Usually treat as Low or Medium, or close as a detection-quality issue if the practical security impact is minimal.
 - Is the vulnerable code only reachable via an optional dependency that is not installed by default? May reduce severity one tier.

diff --git a/docs/user/security-model.md b/docs/user/security-model.md
@@ -14,6 +14,7 @@ ModelAudit is a static security scanner for model artifacts. It analyzes files a
 - It does not prove a model is safe. A clean scan means "no known indicators were found," not "risk is zero."
 - It does not execute model behavior, so runtime-only backdoors and environment-triggered logic may not be visible.
 - It does not replace environment hardening (sandboxing, network controls, least privilege, egress controls).
+- It does not redact or mask local evidence, reports, diagnostics, logs, or cache metadata, including secrets and credentials. Raw output is intentional; see the [security policy](../../SECURITY.md#raw-local-output-no-redaction).
 - Coverage depends on file format support and installed optional dependencies.
 
 ## Operational assumptions