Security

1. Reporting a vulnerability

Email security@narrative.sh. A report is most useful when it carries:

• What the issue is, and what an attacker gets out of it.
• The affected component — a URL, an API endpoint, or a service name such as the content credential signer.
• Steps to reproduce it, including any account or campaign the report touches.
• How you would like to be credited, if you want to be.

Expect an acknowledgement within 3 business days. We will tell you what we found, what we are doing about it, and when the fix ships. Please do not open a public issue for an unpatched vulnerability, and please give us a chance to fix it before disclosing.

Test against your own account and your own campaigns. Do not access another person's data, degrade the service for other players, or run automated scanning that amounts to a denial-of-service. Research conducted in good faith along those lines is welcome, and we will not pursue action over it.

2. Content credential non-conformance

Narrative Nexus attaches C2PA content credentials to AI-generated artwork produced from a licensed artist reference. The credential records that the image was AI-generated, which provider and model made it, and which artist's reference it was derived from — so that the claim is checkable by anyone rather than merely asserted by us.

Send the same address a report if you find that a credential we signed does not conform to the C2PA specification or to the C2PA Conformance Program. Concretely, that includes:

• A manifest that a conforming validator rejects, or that fails to reach a trusted state.
• A claim whose recorded facts do not match the image it is attached to.
• Attribution in a credential that names the wrong artist, or names one who did not license the reference.
• An image presented as credentialed that carries no manifest, or a manifest that has been tampered with.

Include the image, or a link to it, so we can read the manifest back ourselves. A non-conformance report is handled on the same clock as a security report, and it carries a second obligation: where a report establishes that our generator product no longer meets the C2PA Conformance Program requirements, we notify the C2PA within 72 hours of that discovery and remediate as soon as commercially reasonable.

3. Out of scope

These reach us often and we generally will not act on them: missing security headers with no demonstrated impact, results copied from an automated scanner without a working reproduction, rate-limiting or brute-force reports on endpoints that already rate-limit, social engineering of our staff or our players, and vulnerabilities in third-party services we do not operate. Report those to the service that owns them.

4. How we handle security on our side

Dependencies are scanned against advisory databases on every change to a lockfile and weekly besides, because advisories publish on their own schedule rather than ours. A CRITICAL or HIGH finding in a shipped artifact is remediated within 90 days of detection, and anything reaching the claim-signing path is expedited well inside that. The scan gates the build, so a release carrying such a finding is a visibly broken main branch rather than a quiet regression.

The signer that holds the C2PA claim signing key runs with no public IP address, verifies every manifest it produces by reading it back out of the signed bytes, and refuses to return anything it could not verify.