lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Hugging Face

Hugging FaceAI API1 credential

Credentials1 documented
01

User Access Token

huggingface / user-access-token

Hugging Face User Access Tokens authenticate Hub, git, library, and Inference Provider access. Hugging Face documents tokens with the hf_ prefix and recommends separate tokens per app or usage.

user definedsecrettoken

Looks like

example
example
hf_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Location

environment
HF_TOKEN, HUGGING_FACE_HUB_TOKEN
http header
Authorization

Bearer token used by Hub and Inference Provider API calls

config file
~/.cache/huggingface/token, ~/.cache/huggingface/stored_tokens

Default local token files used by huggingface_hub and the hf CLI; HF_HOME and HF_TOKEN_PATH can relocate these files.

source code

notebooks, model-loading scripts, training jobs, committed .env files

secret store

CI/CD variables, Spaces secrets, cloud secret managers

logs

git, HTTP, or notebook output that prints bearer tokens

config file
.env, config.yml, config.yaml, values.yaml

Project-local configuration filenames; lower-confidence fallback scan targets

Notes

Token scope controls whether a leak grants read, write, or admin-style Hub access. A write token can publish or overwrite models, datasets, and Spaces reachable by the account. HF_TOKEN takes priority over the backward-compatible HUGGING_FACE_HUB_TOKEN environment variable. The hf CLI also supports saving tokens to configured git credential helpers, but those helper files are generic credential stores rather than Hugging Face-owned scanner surfaces. HUGGINGFACEHUB_API_TOKEN was omitted from the environment location because it was not found in current official huggingface_hub documentation or source during verification.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.