huggingface/safetensors
Source: https://github.com/safetensors/safetensors
L07 2026-10-17: canonical URL updated from https://github.com/huggingface/safetensors (GitHub redirect to https://github.com/safetensors/safetensors).
Structured fields
{
"archived": false,
"checked_at": "2026-10-17T00:00:00.000Z",
"usefulness": "The tensor file format that replaced pickle checkpoints for model weights and LoRAs: no arbitrary-code-execution on load, zero-copy, lazy loading. Core model-hygiene reference when downloading community checkpoints.",
"source_type": "repository",
"availability": "available",
"next_check_at": "2026-10-20T00:00:00.000Z",
"known_limitations": [
"Safe format does not make a downloaded model trustworthy; custom loader code and other file types in a model repo remain separate risks (inference)."
],
"upstream_updated_at": "2026-10-06T17:33:11.000Z"
}Evidence claims
- [upstream_claim] README: a simple format for storing tensors safely 'as opposed to pickle' and still fast (zero-copy); format is an 8-byte little-endian header size, a JSON header with dtype/shape/offsets and an optional __metadata__ map, then the raw buffer. source
- [upstream_claim] README notes the format does not check tensor values (NaN/Inf can be present) and caps the header at 100MB to limit denial-of-service. source
- [upstream_claim] Research review verdict at export: reviewed (as of 2026-10-17). Recorded by the research pipeline, not a hub review outcome; evidence.review stays unreviewed until an independent reviewer records one.
Rights
| component | license | hosting | redistribution | modification | training | Evidence and notes |
|---|---|---|---|---|---|---|
| code | Apache-2.0 | permitted | permitted | permitted | unknown | Repository page states Apache-2.0. |