Please report vulnerabilities privately through GitHub's private vulnerability reporting for this repository. Do not open a public issue.

Only the latest release and the main branch receive fixes.

The store accepts C2PA Manifest Stores from anonymous uploaders on its testnet instance and signs ISCC declarations with its own key. Reports about parser crashes, resource exhaustion, overwriting or deleting another uploader's manifest, and anything that makes the store declare content it does not host are especially welcome.