๐Ÿšฉ Report

#1
by Yash911 - opened

Copied my space "Yash911/t2i" with API keys without my permission.

Hi @Yash911 , it seems indeed that @farooq-09 copied the credentials you used in your Space, such as HF and cloudinary tokens.

As a general rule, you should never expose any token publicly anywhere; for Spaces specifically you should use Spaces Secrets (you can find the documentation at https://huggingface.co/docs/hub/spaces-overview#managing-secrets).

Exposing such tokens in the code directly allows anyone on the internet to find them and reuse them, potentially resulting in additional charges for you if one of the service is a paid one.
You should immediately rotate your tokens (for the HF token, you can do so at https://hf.co/settings/tokens), and switch to using Spaces Secrets in your Space (or you can make the Space private so the code is only visible to you, but in any case you should rotate your tokens first, as they're already visible publicly currently).

@farooq-09 we ask that you stop reusing the credentials mistakingly exposed by @Yash911 in their code.

Sign up or log in to comment