Security

Model credentials and API keys are never serialised when calling model.to_dict(). The to_dict() method in src/smolagents/models.py explicitly prints a warning and skips token and api_key attributes. All other model parameters (endpoint, provider, temperature, etc.) are included.

For secrets management in practice, the library loads a .env file automatically via python-dotenv if it is installed (the import is guarded with a try/except in src/smolagents/remote_executors.py). SECURITY.md at the repo root contains the vulnerability reporting policy. The .github/workflows/trufflehog.yml GitHub Actions workflow runs TruffleHog on every push to prevent secret leaks into the repository.

Loading tools or agents from the Hub requires explicitly passing trust_remote_code=True; without it, Tool.from_hub() and MultiStepAgent.from_hub() raise a ValueError with a clear explanation.

• src/smolagents/models.py
• src/smolagents/remote_executors.py
• SECURITY.md
• .github/workflows/trufflehog.yml