Report vulnerabilities through GitHub private vulnerability reporting. If unavailable, request a private contact in an issue without disclosing the defect. Include the version, platform and a minimal reproducer.

Scenes, referenced assets and plugins follow the OpenUSD resolver. Local USDC extent checks are not complete parser validation or a sandbox. Applications handling untrusted scenes need process isolation.