README.md

\---

## license: apache-2.0

# Cipheron

**Cipheron** is a lightweight coding model designed for **secure code review**.

It analyzes source code for common security vulnerabilities and attempts to explain the issue and provide a safer implementation.

## What Cipheron Is Good At

Cipheron performs particularly well on:

* **SQL injection** — identifies unsafe query construction and recommends parameterized queries.
* **Command injection** — identifies unsafe shell command construction and recommends safer subprocess-based approaches.

These vulnerability classes are strongly represented in its evaluation data.

## Known Limitations

Cipheron has limited reliability across many security vulnerability categories.

In testing, it struggled with:

* Path traversal
* Hardcoded secrets and API keys
* Weak password hashing
* Insecure deserialization
* Reflected XSS
* Complex multi-step security vulnerabilities

For these cases, the model may produce changes that appear security-related but do not actually eliminate the underlying vulnerability.

**Do not rely on Cipheron as a replacement for professional security review, static analysis, penetration testing, or a larger security-focused model.**

Cipheron is best considered a lightweight, experimental tool for first-pass security analysis and secure-coding experimentation.

## Usage

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model_id = "bencodez/Cipheron"

tokenizer = AutoTokenizer.from_pretrained(model_id)

model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16
)

messages = [
    {
        "role": "system",
        "content": (
            "You are a secure coding assistant. "
            "Review code for security vulnerabilities "
            "and provide fixed, secure versions."
        )
    },
    {
        "role": "user",
        "content": """Review this code for security issues and fix it:

def get_user(username):
    query = "SELECT * FROM users WHERE username = '" + username + "'"
    return db.execute(query)"""
    }
]

input_ids = tokenizer.apply_chat_template(
    messages,
    add_generation_prompt=True,
    return_tensors="pt"
)

with torch.no_grad():
    output = model.generate(
        input_ids,
        max_new_tokens=250
    )

response = tokenizer.decode(
    output[0][input_ids.shape[1]:],
    skip_special_tokens=True
)

print(response)
```

## Local Inference

A quantized `Cipheron-Q8_0.gguf` version is available for lightweight local inference.

Cipheron can be used with compatible local inference runtimes for CPU and other supported devices.

## Intended Use

Cipheron is intended for:

* Secure-coding education
* Security experimentation
* Offline code analysis
* Vulnerability-detection research
* Lightweight local development workflows

## Model Information

| Property       | Value                              |
| -------------- | ---------------------------------- |
| Model          | Cipheron                           |
| Parameters     | 0.5B                               |
| Architecture   | Causal language model              |
| Primary domain | Secure coding                      |
| Input          | Source code and security questions |
| Output         | Security analysis and safer code   |
| License        | Apache 2.0                         |

## Disclaimer

Cipheron is an experimental security-oriented coding model.

Security output should always be independently verified before being used in production systems. A model-generated fix does not guarantee that a vulnerability has been completely eliminated.

## License

Apache 2.0