Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities by emailing the maintainers directly or by using GitHub's private vulnerability reporting.

Include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Affected versions

You can expect an acknowledgement within 5 business days and a resolution timeline within 30 days depending on severity.

ollama-exporter is a CLI tool that runs with the privileges of the invoking user. It is not a daemon and does not bind any network ports. The following trust boundaries are relevant:

The tool communicates with the local Ollama daemon over HTTP (http://localhost:11434 by default). The daemon is assumed to be trusted — it runs under the same user or a trusted system user.

• The OLLAMA_HOST environment variable or --ollama-url flag can redirect this to a remote daemon. Only point these at daemons you control.

The tool authenticates to the target OCI registry with credentials you supply. Credentials are passed via CLI flags or environment variables and are never written to disk by this tool. Use environment variables (OCI_USERNAME, OCI_PASSWORD) rather than CLI flags to avoid credentials appearing in shell history or process listings.

Tar archives produced by export contain model weights and metadata exactly as stored by Ollama. They may be large (several GB). Treat them with the same care as the original model files.

When importing a tar archive (import command), the tool extracts blobs and a manifest into the Ollama model store. It does not execute any content from the archive. Archive members are written only to ~/.ollama/models/ (or OLLAMA_MODELS). Path traversal is not possible because blob filenames are derived from their sha256: digests (no path separators).

• HTTPS is used by default for OCI registry communication. Use --insecure only on networks you fully control.
• No telemetry or analytics of any kind is sent.

• No signature verification: The tool does not verify that model blobs match the digests declared in the manifest before exporting or importing. If your threat model requires integrity verification, compute and compare the sha256 of blobs manually before importing.
• No image signing: Pushed OCI artifacts are not signed (e.g., with Cosign/Sigstore). Add signing as a post-push step if required.
• Credentials in environment: Registry credentials are read from environment variables or CLI flags. Ensure these are not logged by your CI system.