Please report vulnerabilities privately through GitHub's private vulnerability reporting for this repository. Do not open a public issue.

Only the latest release and the main branch receive fixes.

The resolver fetches C2PA Manifests from addresses that anyone can declare. Reports about server-side request forgery, resource exhaustion or response spoofing are especially welcome.