Security and limitations

What runs today

The demo loads the public registry and analyses the snippet directly in your browser. The pasted text is sent neither to ModelShift nor to an AI provider. No generative model is called.

The preview CLI runs on the pilot team's machine or in its CI. It reads files locally, displays findings locally and includes no telemetry. It is not yet publicly distributed: installation is supported during the free pilot.

Data and outbound connections

The preview scanner sends no source code, secret, file path or scan result. The browser downloads only the website's static files and the public JSON registry.

Pro Monitor and Team Policy are commercial hypotheses displayed for validation. There is currently no hosted repository connection, stored GitHub token or customer dashboard. These functions will not be activated without documentation of permissions, retention, hosting region and processors.

What the scanner detects

The preview recognises literal identifiers in text files, including code, configuration and documentation. It compares these strings with a source-backed registry for OpenAI, Anthropic, Gemini and AWS Bedrock.

It can also flag an identifier in a comment or example. Exclusions are controlled by .modelshiftignore. An identifier built dynamically, stored only in a secrets manager or absent from the repository cannot be detected. A result is therefore a risk control, not exhaustive proof of production usage.

CI decisions

Teams choose the exit threshold: informational report, warning or failure for higher levels. ModelShift does not modify files or migrate models automatically. Migration and deployment remain subject to human review and application-specific testing.

Registry and corrections

Each entry identifies an official source, status, deadline and, where published, a replacement. The complete registry can be downloaded as JSON and includes its review date. A provider source always takes precedence over ModelShift.

To report an incorrect date, false positive or vulnerability, email contact@modelshift.fr. Do not send source code or secrets by email.