Found an issue with in-toto? Report it by following the steps in Security issues and bugs.
For a report of our first in-toto code audit, see Security Audit ‘23.