Safetensors
Shares rank 3 of 5 file formats by recommenders
Recommended as a safe alternative to pickle for model weights, since it stores only data and cannot run code on load. Caveat: pth files remain exploitable.
Recommended as a safe alternative to pickle for model weights, since it stores only data and cannot run code on load. Caveat: pth files remain exploitable.
9 people gave an opinion
- recommend it
- 7
- criticize it
- 2
- approval share
- 78%
Recommended in 4 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 7 people recommend itNeeds 10 or more, not met.
- 3.5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 4 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Prevents remote code execution
“Safetensors solves RCE, but it doesn't solve legal liability.”
Comment from 25 Jan 2026 in “I scanned 2,500 Hugging Face models for malware/issues. Here is the data” “which is just data and doesn't suffer from that issue”
Comment from 25 Jan 2026 in “I scanned 2,500 Hugging Face models for malware/issues. Here is the data” Purpose-built fix for pickle
“safetensors was created specifically to address this”
Comment from 10 Apr 2026 in “Show HN: Gemma 4 Multimodal Fine-Tuner for Apple Silicon” “there is already a solution for this, SafeTensors”
Comment from 25 Jan 2026 in “I scanned 2,500 Hugging Face models for malware/issues. Here is the data” “If everyone used Safetensors, this tool wouldn't need to exist”
Comment from 16 Dec 2025 in “AIsbom – open-source CLI to detect "Pickle Bombs" in PyTorch models” Makes pickle-only tools unnecessary
“If everyone used Safetensors, this tool wouldn't need to exist”
Comment from 16 Dec 2025 in “AIsbom – open-source CLI to detect "Pickle Bombs" in PyTorch models” “you'd think it would be worth it to avoid situations like this”
Comment from 24 Mar 2026 in “LiteLLM Python package compromised by supply-chain attack”
What people warn about
Each mark is one comment
Does not cover every security risk
“Safetensors solves RCE, but it doesn't solve legal liability.”
Comment from 25 Jan 2026 in “I scanned 2,500 Hugging Face models for malware/issues. Here is the data” “safetensors is just as vulnerable to this sort of exploit using a pth file since it's a Python package.”
Comment from 24 Mar 2026 in “LiteLLM Python package compromised by supply-chain attack”
Other file formats people recommend
The four most recommended other file formats, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Apache Parquet | 40 | 17 | 70% | 12 | — | Approved |
| Gwtar | 10 | 7 | 59% | 1 | — | — |
| SafetensorsThis page | 7 | 2 | 78% | 4 | — | — |
| JSON Canvas | 7 | 3 | 70% | 2 | — | — |
| F3 file format | 6 | 5 | 55% | 2 | — | — |
What people said
All 9 comments that mention it, newest first. Each links to the original comment.
“way more convenient than using Safetensors and configuring the default Jinja prompt by-hand”
“safetensors was created specifically to address this”
“safetensors is just as vulnerable to this sort of exploit using a pth file since it's a Python package.”
“you'd think it would be worth it to avoid situations like this”
“Safetensors solves RCE, but it doesn't solve legal liability.”
“which is just data and doesn't suffer from that issue”
“there is already a solution for this, SafeTensors”
“If everyone used Safetensors, this tool wouldn't need to exist”
“tools that dont allow executing pickles from checkpoints”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.