A model file in a pull request is a binary the reviewer cannot read, so review the things around it: file format, hash, source and revision, license, the loader code, and who approved it. Block the merge unless each is recorded, and prefer formats that cannot run code on load.
Why a diff is not enough
A diff of a weights file shows only "binary file changed." The risk sits in properties you cannot see: whether the file is a pickle, where it came from, and whether the code that loads it enables something dangerous. Review the metadata, because the content is opaque.
The checklist
| Check | What to look for |
|---|---|
| Format | Safetensors or similar data formats are preferred. Pickle based files such as pytorch_model.bin need a stronger reason |
| Source | Owner, repo name and full commit hash recorded in the pull request description |
| Hash | A file hash in a manifest committed beside the file |
| License | License tag recorded and checked against your use |
| Size | Does it match what the source lists? An unexpected size is a prompt to ask |
| Loader code | Any call that loads with pickle, allows remote code, or loads from a path built from user input |
| Storage | Should the file be in git at all, or in an artifact store with a pointer |
| Approval | A named approver from the model intake process |
Loader code deserves the closest read
The loader decides what happens when the file opens. In the Transformers documentation, custom model code requires an explicit trust_remote_code setting to load. Search the diff for that flag, for calls to pickle load, and for torch load. If you find one, ask why a safer path will not do. See what does trust_remote_code do in Transformers.
Git and large files
Large files are often tracked with pointer files rather than content. A reviewer then sees only a small text pointer. Make sure CI verifies the real file against the manifest hash, because a pointer proves nothing about the content. For more on this see Git LFS pointer files: what dependency scanners see.
Enforce it with a gate
Humans skip steps when tired. Add a pipeline check that fails when a new file with a model extension appears without a manifest entry, a license field and an approver. A rule that is checked automatically is applied every time.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a failed check blocks the merge and says why.
Safeguard's policies and gates can block pull requests on dependency findings, and its SBOM and dependency scanning cover the libraries around the model. Try the free scan.
Quick check
Can a reviewer judge a model file by opening it?
No. Review format, source, hash, license and the loader code instead.
Is a Git LFS pointer proof of the file content?
No. Verify the real file against a committed hash in CI.
Sources
- Hugging Face Transformers documentation, Custom models
- Hugging Face Hub documentation, Pickle Scanning
Last reviewed: 19 October 2026.
