Please do not report security vulnerabilities in a public issue, pull request, or discussion.

Use GitHub's private vulnerability reporting for this repository:

https://github.com/animu-sphere/usd-vrm-plugins/security/advisories/new

Include enough detail to reproduce the problem, the affected version or commit, and any suggested mitigation. Do not include secrets or private user data in the report.

If private vulnerability reporting is unavailable, contact the repository maintainers privately through GitHub and clearly mark the message as a security report.

Maintainers will acknowledge the report when they can, investigate it, and coordinate disclosure and a fix with the reporter. Please give maintainers a reasonable opportunity to address a vulnerability before making it public.

The latest release and the main branch are the supported security targets.