If you discover a security issue (for example a crash when parsing untrusted image bytes through the Node API), please do not open a public GitHub issue.

Prefer one of:

1. GitHub Security Advisories for localtools/ai-meta-node (private report), or
2. Contact the maintainers via the organization listed on https://github.com/localtools

Include:

• Package version (@localtools/ai-meta) and linked ai_meta library version (LIBAI_META_VERSION / version())
• Node.js version and OS
• A minimal proof-of-concept script or image bytes
• Impact (crash, memory corruption, unexpected overwrite, etc.)

Issues that originate in the C library should also be reported upstream to localtools/ai-meta.

• The addon passes caller-provided Buffers to ai_meta; treat image uploads as untrusted input.
• C2PA signatures are not cryptographically verified by the underlying library.