v0.1.0-rc.1

First release candidate of secure-metadata, a privacy-first, local-only TypeScript library for inspecting, cleaning, and verifying metadata in JPEG, PNG, and WebP files.

This is a pre-1.0 release candidate intended for validation before the first stable v0.1.0 release.

Highlights
JPEG metadata inspection, cleaning, and verification
PNG metadata inspection, cleaning, and verification
WebP metadata inspection, cleaning, and verification
Shared bounded TIFF / EXIF decoder
Privacy-focused default cleaning policy
Deterministic binary parsing with strict bounds checking
Malformed-input handling designed to remain bounded
Zero runtime dependencies
Browser and Node-compatible core
Standalone browser ESM artifact
Reproducible release artifacts with SHA-256 verification
Privacy Clean defaults

The default policy removes privacy-relevant metadata that can be identified confidently while preserving rendering-critical and unknown structures where appropriate.

Default policy:

removeExif true
removeXmp true
removeIptc true
removeComments true
removeTextMetadata true
removeTimestamps true
preserveIcc true

ICC/color profiles are preserved by default.

Unknown metadata and image/container structures are not removed merely by assumption.

Supported formats
JPEG

Supports bounded JPEG parsing including:

APP0–APP15
EXIF
XMP / Extended XMP
ICC
Photoshop/IPTC
COM
multi-scan JPEG
entropy-coded scan preservation
shared TIFF / EXIF decoding
cleaning and verification

Privacy Clean removes EXIF, XMP, Extended XMP, IPTC, and comments while preserving ICC, JFIF/JFXX, Adobe APP14, unknown APP segments, and image scan data.

PNG

Supports:

standard PNG chunk parsing
eXIf
tEXt
zTXt
iTXt
XMP iTXt detection
iCCP
tIME
rendering/color chunks
APNG structures
CRC-32 validation
trailing-data preservation
cleaning and verification

Compressed PNG payloads such as zTXt, compressed iTXt, iCCP, IDAT, and APNG image payloads are not decompressed.

WebP

Supports:

RIFF/WebP parsing
VP8 / VP8L / VP8X
ALPH
ANIM / ANMF
EXIF
XMP
ICCP
unknown chunks
trailing-data preservation
RIFF size repair
VP8X metadata feature-bit repair
cleaning and verification

WebP EXIF is currently detected at the container level only and is not decoded through the shared TIFF decoder.

TIFF / EXIF decoding

The shared TIFF core supports:

little-endian and big-endian TIFF
bounded iterative IFD traversal
cycle detection
depth and entry limits
common IFD0 / ExifIFD fields
GPS metadata
exact rational representation
duplicate tags
unknown-tag structural handling
opaque MakerNote handling

GPS coordinates are retained as exact rational values rather than automatically converted to decimal coordinates.

Verification model

Verification reports observable metadata state using:

present
absent
ignore

Verification intentionally does not claim complete file privacy or prove provenance from an original file.

If metadata inspection is truncated by configured safety limits, verification fails closed rather than inferring absence.

Security and robustness

The library treats all binary input as untrusted.

Current safeguards include:

strict binary bounds checks
parser input limits
segment/chunk limits
metadata entry limits
TIFF traversal limits
diagnostic limits
cycle detection
malformed-input corpus tests
property-based testing
deterministic fuzz testing

No image pixel decoding or image re-encoding is performed.

Validation

This release candidate passed:

27 test files
235 deterministic tests
250 deterministic fuzz iterations
real Chromium browser-artifact smoke testing
npm package-content audit
license audit across 172 transitive development packages
npm vulnerability audit
reproducibility verification across two clean builds
SHA-256 verification

The public runtime surface is frozen to 19 exports for the current v0.1.x contract.

Package state
Runtime dependencies: 0
npm payload: 9 files
Packed package size: 95,784 bytes
Unpacked package size: 521,528 bytes
Standalone browser artifact: 85,034 bytes
npm vulnerabilities: 0
Release artifacts
npm package
secure-metadata-0.1.0.tgz
SHA-256:
d7e1c5069651fa4d879eab26e2d1a2c577cad586c7b56b2df7d5819ae53186ea
Browser artifact
secure-metadata-0.1.0.browser.js
SHA-256:
8d0b8a1addf904760aa1f52378fb05eed6540520cb05fe2320d77011cba69c28

A SHA256SUMS manifest is also generated as part of the release process.

Reproducibility

Two clean builds from the same source state produced byte-identical release artifacts.

Release artifacts are traceable to:

Commit:
352258e
Important limitations

This release does not claim exhaustive metadata decoding.

Notable limitations include:

WebP EXIF is container-detection only
compressed PNG metadata payloads are not decompressed
MakerNote remains opaque
unknown metadata may intentionally be preserved
ICC/color profiles are preserved by default
metadata-inspected remains reserved for future exhaustive inspection
verification observes metadata state only
verification does not guarantee complete privacy
verification cannot prove that metadata was preserved from an original file without access to that original
Pre-release notice

secure-metadata is pre-1.0 software.

The v0.1.x public surface is intentionally defined and tested, but breaking changes may still occur in later pre-1.0 minor releases. Such changes will be documented.

This release candidate is intended for validation before the first stable v0.1.0 release.