Security

If you find a way to forge, replay or strip proof references so that a verifier accepts a purchase that did not match its mandate, report it privately to the maintainer, Craig Thomas Ellrod, through a GitHub security advisory on this repository before public disclosure.

Vulnerabilities in ACP itself belong with the ACP maintainers. Do not post exploit code or undisclosed vulnerability details in issues or pull requests.