Space secrets security update
📰 Hugging Face Blog
Hugging Face's Spaces platform experienced unauthorized access to secrets, prompting a security update and recommendations for users to refresh keys and tokens
Action Steps
- Refresh any key or token
- Consider switching to fine-grained access tokens
- Monitor for suspicious activity and report to security@huggingface.co if necessary
Who Needs to Know This
The development, security, and DevOps teams can benefit from understanding the security measures taken by Hugging Face to protect their Spaces platform and implement similar measures in their own organizations
Key Insight
💡 Fine-grained access tokens are the new default and provide increased security
Share This
🚨 Security update: Hugging Face's Spaces platform experienced unauthorized access to secrets. Refresh your keys and tokens! 💻
Key Takeaways
Hugging Face's Spaces platform experienced unauthorized access to secrets, prompting a security update and recommendations for users to refresh keys and tokens
Full Article
Published Time: 2024-05-31T00:00:00.400Z
# Space secrets security update
[Hugging Face](https://huggingface.co/)
* [Models](https://huggingface.co/models)
* [Datasets](https://huggingface.co/datasets)
* [Spaces](https://huggingface.co/spaces)
* [Buckets new](https://huggingface.co/storage)
* [Docs](https://huggingface.co/docs)
* [Enterprise](https://huggingface.co/enterprise)
* [Pricing](https://huggingface.co/pricing)
*
*
* * *
* [Log In](https://huggingface.co/login)
* [Sign Up](https://huggingface.co/join)
[Back to Articles](https://huggingface.co/blog)
# [](https://huggingface.co/blog/space-secrets-disclosure#space-secrets-leak-disclosure) Space secrets leak disclosure
Published May 31, 2024
[Update on GitHub](https://github.com/huggingface/blog/blob/main/space-secrets-disclosure.md)
[- [x] Upvote 52](https://huggingface.co/login?next=%2Fblog%2Fspace-secrets-disclosure)
* [](https://huggingface.co/yjernite "yjernite")
* [](https://huggingface.co/lewtun "lewtun")
* [](https://huggingface.co/nbroad "nbroad")
* [](https://huggingface.co/abhishek "abhishek")
* [](https://huggingface.co/MoritzLaurer "MoritzLaurer")
* [](https://huggingface.co/osanseviero "osanseviero")
* +46
[](https://huggingface.co/system)
[system system Follow](https://huggingface.co/system)
Earlier this week our team detected unauthorized access to our Spaces platform, specifically related to Spaces secrets. As a consequence, we have suspicions that a subset of Spaces’ secrets could have been accessed without authorization.
As a first step of remediation, we have revoked a number of HF tokens present in those secrets. Users whose tokens have been revoked already received an email notice. **We recommend you refresh any key or token and consider switching your HF tokens to fine-grained access tokens which are the new default.**
We are working with outside cyber security forensic specialists, to investigate the issue as well as review our security policies and procedures.
Over the past few days, we have made other significant improvements to the security of the Spaces infrastructure, including completely removing org tokens (resulting in increased traceability and audit capabilities), implementing key management service (KMS) for Spaces secrets, robustifying and expanding our system’s ability to identify leaked tokens and proactively invalidate them, and more generally improving our security across the board. We also plan on completely deprecating “classic” read and write tokens in the near future, as soon as fine-grained access tokens reach feature parity. We will continue to investigate any possible related incident.
Finally, we have also reported this incident to law enforcement agencies and Data protection authorities.
We deeply regret the disruption this incident may have caused and understand the inconvenience it may have posed to you. We pledge to use this as an opportunity to strengthen the security of our entire infrastructure. For any question, please contact us at [security@huggingface.co](mailto:security@huggingface
# Space secrets security update
[Hugging Face](https://huggingface.co/)
* [Models](https://huggingface.co/models)
* [Datasets](https://huggingface.co/datasets)
* [Spaces](https://huggingface.co/spaces)
* [Buckets new](https://huggingface.co/storage)
* [Docs](https://huggingface.co/docs)
* [Enterprise](https://huggingface.co/enterprise)
* [Pricing](https://huggingface.co/pricing)
*
*
* * *
* [Log In](https://huggingface.co/login)
* [Sign Up](https://huggingface.co/join)
[Back to Articles](https://huggingface.co/blog)
# [](https://huggingface.co/blog/space-secrets-disclosure#space-secrets-leak-disclosure) Space secrets leak disclosure
Published May 31, 2024
[Update on GitHub](https://github.com/huggingface/blog/blob/main/space-secrets-disclosure.md)
[- [x] Upvote 52](https://huggingface.co/login?next=%2Fblog%2Fspace-secrets-disclosure)
* [](https://huggingface.co/yjernite "yjernite")
* [](https://huggingface.co/lewtun "lewtun")
* [](https://huggingface.co/nbroad "nbroad")
* [](https://huggingface.co/abhishek "abhishek")
* [](https://huggingface.co/MoritzLaurer "MoritzLaurer")
* [](https://huggingface.co/osanseviero "osanseviero")
* +46
[](https://huggingface.co/system)
[system system Follow](https://huggingface.co/system)
Earlier this week our team detected unauthorized access to our Spaces platform, specifically related to Spaces secrets. As a consequence, we have suspicions that a subset of Spaces’ secrets could have been accessed without authorization.
As a first step of remediation, we have revoked a number of HF tokens present in those secrets. Users whose tokens have been revoked already received an email notice. **We recommend you refresh any key or token and consider switching your HF tokens to fine-grained access tokens which are the new default.**
We are working with outside cyber security forensic specialists, to investigate the issue as well as review our security policies and procedures.
Over the past few days, we have made other significant improvements to the security of the Spaces infrastructure, including completely removing org tokens (resulting in increased traceability and audit capabilities), implementing key management service (KMS) for Spaces secrets, robustifying and expanding our system’s ability to identify leaked tokens and proactively invalidate them, and more generally improving our security across the board. We also plan on completely deprecating “classic” read and write tokens in the near future, as soon as fine-grained access tokens reach feature parity. We will continue to investigate any possible related incident.
Finally, we have also reported this incident to law enforcement agencies and Data protection authorities.
We deeply regret the disruption this incident may have caused and understand the inconvenience it may have posed to you. We pledge to use this as an opportunity to strengthen the security of our entire infrastructure. For any question, please contact us at [security@huggingface.co](mailto:security@huggingface
DeepCamp AI