Hugging Face Spaces Secrets Accessed by Intruders
A central hub of the model supply chain had to tell everyone: rotate your keys, someone reached our secrets store.
| When | May 2024 |
|---|---|
| Target | Hugging Face Spaces (secrets store) |
| Vendor | Hugging Face |
| Cause | Unauthorized access to stored Spaces secrets |
| Response | Tokens revoked; users notified; KMS + fine-grained tokens |
- 1Hugging Face detects unauthorized access to secrets stored in Spaces
- 2It revokes a subset of tokens and notifies affected users
- 3Users rotate keys; HF moves to a KMS and fine-grained tokens
What happened
On 31 May 2024, Hugging Face disclosed that it had detected unauthorized access to secrets stored in its Spaces service. It revoked a subset of HF tokens, emailed affected users, and urged rotation to fine-grained tokens — later hardening its setup with a key-management service. This is distinct from the December 2023 research that found 1,600+ tokens hardcoded in public repos; here the platform's own secrets store was accessed.
How it happened
Spaces hosts apps and demos, and developers store API tokens and keys there as secrets. Access to those secrets can reach the models, datasets and downstream services they unlock — so a breach of the store is a supply-chain problem, not one app's issue.
Root cause
Concentration of high-value credentials in a single platform secrets store, where one intrusion has broad blast radius across the ecosystem.
Why it matters
The model supply chain runs through a handful of hubs. When one has a secrets incident, every downstream project that trusted it must assume exposure and rotate.
How to prevent it
- Use fine-grained, least-privilege tokens and rotate on any provider incident.
- Don't let a single platform secret guard high-value models or data.
- Segregate and monitor secrets access for anomalous use.
FAQ
What is Spaces and why do its secrets matter?
Spaces hosts apps and demos, and developers store API tokens and keys there as secrets. Unauthorized access to those secrets can reach the models, datasets and downstream services they unlock — a supply-chain concern, not just one app's problem.
Is this the same as the 2023 exposed-token research?
No. That was researchers finding 1,600+ tokens hardcoded in public GitHub/HF repos. This is an actual intrusion into Hugging Face's own Spaces secrets store, disclosed and remediated by the platform.
How do you reduce this blast radius?
Use fine-grained, least-privilege tokens, rotate on any provider incident, and don't rely on a single platform secret to guard high-value models or datasets.
Sources
- Space secrets security update — Hugging Face