MODEL SUPPLY-CHAIN SECURITY

Is this ML model file safe to load?

Pickle-based model files (.pkl, .joblib, .pt, .pth) can run arbitrary code the moment you torch.load / joblib.load them. PickleScan statically disassembles the file and flags code-execution gadgets — without ever unpickling it.

Drop a model file here, or tap to choose .pkl · .joblib · .pt · .pth · .bin — up to 25 MB. Nothing is stored.

Scanning a whole repo or CI pipeline?

PickleScan Pro is a CLI + GitHub Action that scans every model artifact in your project, fails the build on dangerous files, and outputs JSON/SARIF. Lifetime license, one-time $29.

Recursive folder & glob scan
GitHub Action

JSON + SARIF output
Exit codes for CI gating

Get PickleScan Pro — $29 →

New to pickle security?

Read the plain-English guides:

How it works

Uses Python's pickletools to read opcodes — it never executes the file.
Flags GLOBAL/STACK_GLOBAL imports of os, subprocess, builtins.eval, etc.
Understands PyTorch/joblib ZIP containers and inspects embedded pickle streams.
Known ML-stack imports (numpy, torch, sklearn…) are allow-listed so real models read clean.