Use GitHub private vulnerability reporting, which creates a private security advisory, for:
- Security vulnerabilities in cadmpeg, including unsafe handling of untrusted CAD files.
- Suspected clean-room, licensing, or provenance violations whose disclosure would expose confidential or non-public information.
- Takedown requests that contain sensitive personal, legal, ownership, or technical details.
This is the project's sole private reporting channel. Do not disclose a vulnerability publicly before the maintainers have reviewed it.
Include the affected files, commits, versions, or format sections; the impact; reproduction steps or a minimal proof of concept when applicable; the basis of any provenance or ownership concern; and the requested remedy. Do not attach CAD files, source material, credentials, or other content that you are not entitled to possess or share.
Use a public GitHub issue for ordinary bugs, feature requests, documentation problems, and non-sensitive provenance or licensing concerns. Reports that require confidential details belong in private vulnerability reporting.