GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
scthornton
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
scthornton
Model Tree
Qwen/Qwen2.5-Coder-7B-Instruct
Input Modalities
Output Modalities
Supported Functionality
This model generates secure code when developers ask about building features. Instead of producing vulnerable implementations (like 45% of AI-generated code does), it:
The model was fine-tuned on 2,372 security training examples covering both traditional web security (OWASP Top 10 2021) and AI/ML security (OWASP LLM Top 10 2025).
| Base Model | Qwen2.5 Coder 7B Instruct |
| Parameters | 7B |
| Architecture | Qwen2 |
| Tier | Tier 2: Mid-size Code Specialist |
| Method | bf16 LoRA (no quantization) |
| LoRA Rank | 16 (alpha=32) |
| Target Modules | q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj (7 modules) |
| Training Data | scthornton/securecode (2,372 examples) |
| Hardware | NVIDIA DGX Spark GB10 (Blackwell, unified memory) |
Purpose-built code model with strong multi-language support. Excellent balance of capability and efficiency.
python
from peft import PeftModelfrom transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfigimport torch # Optional: 4-bit quantization for low-VRAM inference (training was bf16 LoRA)bnb_config = BitsAndBytesConfig( load_in_4bit=True, bnb_4bit_quant_type="nf4", bnb_4bit_compute_dtype=torch.bfloat16,) base_model = AutoModelForCausalLM.from_pretrained( "Qwen/Qwen2.5-Coder-7B-Instruct", quantization_config=bnb_config, device_map="auto",)tokenizer = AutoTokenizer.from_pretrained("scthornton/qwen2.5-coder-7b-securecode")model = PeftModel.from_pretrained(base_model, "scthornton/qwen2.5-coder-7b-securecode") # Ask a security-relevant coding questionmessages = [ {"role": "user", "content": "How do I implement JWT authentication with refresh tokens in Python?"}] inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)outputs = model.generate(inputs, max_new_tokens=2048, temperature=0.7)print(tokenizer.decode(outputs[0], skip_special_tokens=True))Trained on the full SecureCode unified dataset:
| Parameter | Value |
|---|---|
| LoRA rank | 16 |
| LoRA alpha | 32 |
| LoRA dropout | 0.05 |
| Target modules | 7 linear layers |
| Quantization | None (bf16 base weights) |
| Learning rate | 2e-4 |
| LR scheduler | Cosine with 100-step warmup |
| Epochs | 3 |
| Per-device batch size | 2 |
| Gradient accumulation | 8x |
| Effective batch size | 16 |
| Max sequence length | 4096 tokens |
| Optimizer | adamw_torch_fused |
| Attention | PyTorch SDPA (fused) |
| Precision | bf16 |
Notes: Extended 4096-token context for longer security conversations. Requires trust_remote_code=True.
OWASP Top 10 2021: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software Integrity Failures, Logging/Monitoring Failures, SSRF.
Languages: Python, JavaScript, Java, Go, PHP, C#, TypeScript, Ruby, Rust, Kotlin, YAML.
OWASP LLM Top 10 2025: Prompt Injection, Sensitive Information Disclosure, Supply Chain Vulnerabilities, Data/Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded Consumption.
Frameworks: LangChain, OpenAI, Anthropic, HuggingFace, LlamaIndex, ChromaDB, Pinecone, FastAPI, Flask, vLLM, CrewAI, and 30+ more.
This model is part of the SecureCode collection of 9 security-specialized models:
| Model | Base | Size | Tier | HuggingFace |
|---|---|---|---|---|
| Llama 3.2 SecureCode | meta-llama/Llama-3.2-3B-Instruct | 3B | Accessible | llama-3.2-3b-securecode |
| Gemma 4 E4B SecureCode | google/gemma-4-E4B-it | E4B (8B raw) | Accessible | gemma-4-e4b-securecode |
| Qwen2.5 Coder SecureCode | Qwen/Qwen2.5-Coder-7B-Instruct | 7B | Mid-size | qwen2.5-coder-7b-securecode |
| DeepSeek Coder SecureCode | deepseek-ai/deepseek-coder-6.7b-instruct | 6.7B | Mid-size | deepseek-coder-6.7b-securecode |
| CodeGemma SecureCode | google/codegemma-7b-it | 7B | Mid-size | codegemma-7b-securecode |
| CodeLlama SecureCode | codellama/CodeLlama-13b-Instruct-hf | 13B | Large | codellama-13b-securecode |
| Qwen2.5 Coder 14B SecureCode | Qwen/Qwen2.5-Coder-14B-Instruct | 14B | Large | qwen2.5-coder-14b-securecode |
| StarCoder2 SecureCode | bigcode/starcoder2-15b-instruct-v0.1 | 15B | Large | starcoder2-15b-securecode |
| Granite 20B Code SecureCode | ibm-granite/granite-20b-code-instruct-8k | 20B | XL | granite-20b-code-securecode |
Choose based on your deployment constraints: 3B for edge/mobile, 7B for general use, 13B-15B for deeper reasoning, 20B for maximum capability.
| Dataset | Examples | Focus | Link |
|---|---|---|---|
| SecureCode | 2,372 | Unified (web + AI/ML) | scthornton/securecode |
| SecureCode Web | 1,625 | Web security (OWASP Top 10 2021) | scthornton/securecode-web |
| SecureCode AI/ML | 747 | AI/ML security (OWASP LLM Top 10 2025) | scthornton/securecode-aiml |
Use this model for:
Do not use this model for:
bibtex
@misc{thornton2026securecode, title={SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models}, author={Thornton, Scott}, year={2026}, publisher={perfecXion.ai}, url={https://huggingface.co/datasets/scthornton/securecode}, note={arXiv:2512.18542}}This model is released under the apache-2.0 license (inherited from the base model). The training dataset (SecureCode) is licensed under CC BY-NC-SA 4.0.
from peft import PeftModelfrom transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfigimport torch # Optional: 4-bit quantization for low-VRAM inference (training was bf16 LoRA)bnb_config = BitsAndBytesConfig( load_in_4bit=True, bnb_4bit_quant_type="nf4", bnb_4bit_compute_dtype=torch.bfloat16,) base_model = AutoModelForCausalLM.from_pretrained( "Qwen/Qwen2.5-Coder-7B-Instruct", quantization_config=bnb_config, device_map="auto",)tokenizer = AutoTokenizer.from_pretrained("scthornton/qwen2.5-coder-7b-securecode")model = PeftModel.from_pretrained(base_model, "scthornton/qwen2.5-coder-7b-securecode") # Ask a security-relevant coding questionmessages = [ {"role": "user", "content": "How do I implement JWT authentication with refresh tokens in Python?"}] inputs = tokenizer.apply_chat_template(messages, return_tensors="pt").to(model.device)outputs = model.generate(inputs, max_new_tokens=2048, temperature=0.7)print(tokenizer.decode(outputs[0], skip_special_tokens=True))@misc{thornton2026securecode, title={SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models}, author={Thornton, Scott}, year={2026}, publisher={perfecXion.ai}, url={https://huggingface.co/datasets/scthornton/securecode}, note={arXiv:2512.18542}}