Please do not report a suspected vulnerability in a public issue or pull request. MMD files are untrusted input, so parser crashes, out-of-bounds reads, path handling problems and unsafe build or package behavior are all worth reporting.

Use GitHub's private Report a vulnerability form. Include only what is needed to reproduce the problem. A useful report usually contains:

• the affected commit, release or component;
• the impact you observed;
• reproduction steps or a small generated fixture;
• the operating system, OpenUSD version and build mode.

Do not upload a model, texture, motion, credential or private file unless you have permission to share it. If private vulnerability reporting is unavailable, open a minimal issue asking for a private contact and do not include technical details.

Maintainers will acknowledge reports when able, investigate the impact, and coordinate a fix or release as appropriate. Credit is given when requested and when it does not create a safety or privacy concern.

The repository's parser, canonicalization code, USD file format plugin, build scripts, packaging and CI are in scope. Issues that belong to OpenUSD or an external runtime may also need to be reported to that project; mentioning the upstream report in this one is helpful once disclosure is safe.