# Third-party notices

SlopDetect uses `@contentauth/c2pa-web` and related Content Authenticity Initiative packages under their published licenses. See the package metadata and the [c2pa-js repository](https://github.com/contentauth/c2pa-js) for the applicable terms.

The bundled `C2PA-TRUST-LIST.pem` and `C2PA-TSA-TRUST-LIST.pem` files are snapshots from the [C2PA Conformance Program public repository](https://github.com/c2pa-org/conformance-public), published under CC BY 4.0. The Coalition for Content Provenance and Authenticity maintains those lists; inclusion does not imply endorsement of SlopDetect.

Other runtime and development dependencies are listed in `package.json` and retain their respective licenses.