---

license: apache-2.0

base_model: elsiddik/finsec_detector

library_name: unsloth

tags:

• cybersecurity
• vulnerability-detection
• cve
• code-audit
• code-repair
• qwen2.5-coder
• fine-sec

language:

• en
• code

pipeline_tag: text-generation

---

GGUF Files for finsec_detector

These are the GGUF files for elsiddik/finsec_detector.

> [!NOTE]

> Note: this model has only been quantized to Q2_K, Q4_K_M, and Q8_0. Other quantizations may become available later.

Downloads

| GGUF Link | Quantization | Description |

| ---- | ----- | ----------- |

| Download | Q2_K | Lowest quality |

| Download | Q4_K_M | Recommended: Perfect mix of speed and performance |

| Download | Q8_0 | Best quality |

| Download | f16 | Full precision, don't bother; use a quant |

Note from Flexan

I provide GGUFs and quantizations of publicly available models that do not have a GGUF equivalent available yet,

usually for models I deem interesting and wish to try out.

If there are some quants missing that you'd like me to add, you may request one in the community tab.

If you want to request a public model to be converted, you can also request that in the community tab.

If you have questions regarding this model, please refer to the original model repo.

You can find more info about me and what I do here.

FineSec-Detector: Specialized Security LLM (Qwen2.5-Coder-7B-Instruct)

FineSec-Detector is a 7B parameter specialized cybersecurity Large Language Model fine-tuned on high-precision CVE vulnerability reports, real-world exploit benchmarks, and secure code repair patterns using Unsloth 4-bit QLoRA.

The model acts as an automated Senior Application Security (AppSec) Auditor. It audits source code, identifies vulnerabilities, classifies severity and CWE IDs, and produces ready-to-merge secure code patches in structured JSON.

---

Verified Benchmark Performance

Evaluating FineSec-Detector on multi-language vulnerability benchmarks (SQL Injection, RCE, XSS, Path Traversal, Insecure Deserialization, Buffer Overflows) yielded the following performance metrics:

| Metric | Score | Rating | Analysis |

|---|---|---|---|

| Precision Rate | 100.0% | Perfect | Zero false positives. Safe code is never misflagged. |

| Detection Recall | 83.3% | High | High-confidence detection across Python, C, JS, and Go. |

| F1 Rating Score | 90.9% | Outstanding | Superior overall vulnerability detection balance. |

---

Key Features

• Automated Vulnerability Detection: Audits Python, C/C++, JavaScript, Go, PHP, Java, and Bash source code.
• Structured JSON Output: Produces standardized security reports suitable for CI/CD pipeline integration.
• CWE and Severity Classification: Classifies bugs into standard CWE categories (e.g., CWE-89 SQLi, CWE-79 XSS, CWE-78 RCE, CWE-120 Buffer Overflow) with CVSS-aligned severity levels (CRITICAL, HIGH, MEDIUM, LOW).
• Remediation and Patching: Generates diffs and secure code refactors directly replacing vulnerable logic.

---

Quickstart: Inference

1. Using Unsloth (Fast and Memory Efficient)

from unsloth import FastLanguageModel

# Load model and tokenizer from Hugging Face Hub
model, tokenizer = FastLanguageModel.from_pretrained(
    model_name = "elsiddik/finsec_detector",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastLanguageModel.for_inference(model)

# Security audit prompt
prompt = """### System Prompt:
You are FineSec-AI, an expert Application Security Engineer. Analyze code snippet for vulnerabilities and output JSON report with fields: 'vulnerabilities' (list of objects with severity, cwe, description, vulnerable_line, fix_code).

### Input Code:

import sqlite3

def login(username, password):

conn = sqlite3.connect('users.db')

cursor = conn.cursor()

query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"

cursor.execute(query)

return cursor.fetchone()

### Security Analysis (JSON):"""

inputs = tokenizer(prompt, return_tensors="pt").to("cuda")
outputs = model.generate(**inputs, max_new_tokens=512, use_cache=True)
print(tokenizer.decode(outputs[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))

---

Sample Output (Structured JSON)

{
  "is_vulnerable": true,
  "severity": "CRITICAL",
  "cwe": "CWE-89",
  "vulnerability_type": "SQL Injection",
  "description": "User input is directly concatenated into the SQL query string without parameterization, allowing unauthenticated SQL injection.",
  "vulnerable_code": "query = f\"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'\"",
  "remediation": "Use parameterized SQL queries with placeholder parameters.",
  "fixed_code": "query = 'SELECT * FROM users WHERE username = ? AND password = ?'\ncursor.execute(query, (username, password))"
}

---

Model Details

| Attribute | Details |

|---|---|

| Base Architecture | Qwen2.5-Coder-7B-Instruct |

| Fine-Tuning Method | QLoRA 4-bit (Unsloth) |

| LoRA Target Modules | q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj |

| LoRA Rank (r) | 16 |

| LoRA Alpha | 32 |

| Context Window | 1024 tokens |

| License | Apache-2.0 |

---

Intended Use and Disclaimer

FineSec-Detector is designed for defensive security purposes, code auditing, secure code development, and AppSec integration. Users are responsible for exercising due diligence when integrating model output into production systems.