The 8 Hugging Face security checks Black Cat runs
Black Cat SSPM evaluates 8 security policies against your Hugging Face configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Hugging Face — what access Black Cat needs, and why.
Access control & privilege (3)
- Resource Group Auto-Join With Write Access severity: high
- Excessive Organization Admins severity: medium
- Member With Org Admin Role severity: low
Other checks (5)
severity: low SSO Not Observed fix difficulty: medium #
Confirm SSO is configured and in use for the organization
- Open Organization Settings > SSO and verify a provider is configured
- Require SSO for member sign-in
- Re-run the scan; org.sso_login events should appear in the audit log
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Public Org Repository fix difficulty: easy #
Review org repositories that are publicly visible
- Open the repository Settings on huggingface.co
- Confirm public exposure is intentional; set to Private if it holds proprietary models, datasets, or code
- For datasets that must be shared, prefer a gated repository over fully public
Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: low Public Gated Repository Misconfiguration fix difficulty: easy #
Consider gating sensitive datasets/models that must remain shareable
- Open the repository Settings
- Enable gated access for models/datasets with usage or licensing constraints
Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: low Audit Logs Unavailable fix difficulty: easy #
Enable an org plan that provides audit logs
- Confirm the organization is on a Team or Enterprise plan
- Ensure the connector token has read access to organization settings
- Re-run the scan to confirm audit events are retrieved
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: high Token Approval Policy Disabled fix difficulty: medium #
Re-enable the access-token approval policy
- Open Organization Settings > Tokens and enable "Require administrator approval"
- Review any tokens authorized while the policy was disabled
- Rotate org tokens if unexpected access occurred
Satisfies: NIS2 Directive NIS2-21.e.3 DORA (SaaS Security) DORA-9.8