If you discover a security issue (for example a crash when parsing untrusted image bytes through the PHP API), please do not open a public GitHub issue.

Prefer one of:

1. GitHub Security Advisories for localtools/ai-meta-php (private report), or
2. Contact the maintainers via the organization listed on https://github.com/localtools

Include:

• Extension version and linked ai_meta library version (LIBAI_META_VERSION / phpinfo)
• PHP version (NTS/ZTS) and OS
• A minimal proof-of-concept script or image bytes
• Impact (crash, memory corruption, unexpected overwrite, etc.)

Issues that originate in the C library should also be reported upstream to localtools/ai-meta.

• The extension passes caller-provided buffers to ai_meta; treat image uploads as untrusted input.
• C2PA signatures are not cryptographically verified by the underlying library.