Hugging Face, Inc.

Hugging Face is a risk and accountability case because its May 2024 Spaces secrets disclosure showed how an AI developer platform can become a custody layer for tokens, API keys, hosted demos, model applications, organization permissions, security scanning, and downstream service access. The public record matters for developers, AI startups, enterprise platform teams, open-source maintainers, model publishers, data teams, regulators, and customers because the incident was not only about a platform detecting unauthorized access. It was about whether users could understand which secrets might have been exposed, which tokens were revoked, which keys still needed rotation, and how hosted AI demos should be governed.