Safetensors solves RCE, but it doesn't solve legal liability. I scan .safetensors because metadata headers often contain restrictive licenses (like CC-BY-NC) that contradict the repo's README. Deploying a non-commercial model in a commercial SaaS is a security/compliance incident, even if no code is executed (PS I'm in the EU and it's important for us).
Additionally, a massive portion of the ecosystem is still stuck on Pickle/PyTorch .bin.
Additionally, a massive portion of the ecosystem is still stuck on Pickle/PyTorch .bin.