Please report vulnerabilities privately using GitHub's "Report a vulnerability" button on this repository's Security tab (private vulnerability reporting). Don't open a public issue for a security problem.

Especially valuable reports:

• a way to make a receipt verify when it shouldn't (signature, log inclusion, or anchor checks);
• a way for a claim to be judged verified from anything other than the destination's own state;
• server-side request forgery or credential leakage in the node's verifiers.

We'll acknowledge a report within a few days and keep you informed until it's fixed.