Opening a notebook you did not write is designed not to run code. Running its cells is different: each cell executes with your permissions. Jupyter marks outputs from unknown notebooks as untrusted, but that protects the viewer, not the person who then clicks Run All.
Opening versus running
Jupyter's security documentation says the model is built on the principle that opening a notebook you did not write should not cause code to run. Untrusted JavaScript is never executed, and Markdown cells never get trusted HTML or JavaScript.
That covers what happens on open. It does not cover what you do next. A cell that downloads a file, reads environment variables or installs a package runs as you, with your files and your cloud credentials in reach.
How the trust system works
When you execute and save a notebook, the server computes a signature from its contents and a secret key, and stores it in a database only your user can write. When you open it later, a matching signature marks HTML and JavaScript output as trusted. If it does not match, that output is untrusted.
The documentation says trust hinges on one question: did the current user produce this output? You can grant trust explicitly with the jupyter trust command or the Trust Notebook menu option, so do that only after reading the notebook.
Where the risk really is
- Cells that run shell commands. Lines starting with an exclamation mark or percent sign run in the shell or magics.
- Package installs. A pip install line pulls code that then runs in your environment.
- Model loading. A cell that loads a pickle checkpoint or passes trust_remote_code runs foreign code.
- Credentials in the environment. Cloud keys and tokens set as environment variables are readable from any cell.
- Saved outputs. Outputs can contain links and rendered content from the author.
A safe routine for notebooks you did not write
- Read it first as text in a viewer, not in a live server.
- Search for shell magics, installs, network calls and file writes.
- Open it in a disposable environment, such as a fresh container with no credentials.
- Run cell by cell and stop at anything you do not understand.
- Do not use the trust command until you are done reading.
- Delete the environment afterward.
grep -nE "^\s*[!%]|pip install|trust_remote_code|torch.load|pickle" notebook.ipynb
This is a rough filter to decide where to read closely, not a verdict.
For notebooks you do own
Clear outputs before sharing. Remove tokens from cells. Hugging Face's own token guidance recommends one token per app or usage, such as a separate one for a Colab notebook, so you can invalidate one without touching the others.
Where Safeguard fits
Notebooks are code with dependencies. Safeguard can generate an SBOM and scan dependencies for projects that use them, with reachability analysis to prioritize what is actually called. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Does an untrusted label mean the notebook is dangerous?
It means Jupyter will not trust the saved HTML and JavaScript outputs. The code cells can still do harm if you run them.
Is a notebook on a public site safe to run on my laptop?
Only after review, and ideally in a disposable environment without credentials.
Sources
Last reviewed: 19 October 2026.
