kohya-ss / kohya-ss/sd-scripts
wandb token exposed to wandb users
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 1.2k
- Avg merge
- 11m
- Merged PRs (30d)
- 2
Description
hello, there exists a parameter to pass a wandb token into the training utility. unfortunately, this shows on the "Overview" tab of the training session, as a part of the complete commandline that is used to execute the trainer.
This exposes users to potentially nefarious activity, or at the very least, a sense of unease and the possibility of snooping/leaking internal data.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the training utility's wandb token parameter and how the complete trainer command line is recorded for the session Overview tab. Done means the token is no longer exposed there while wandb-enabled training continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100