Security policy
Supported versions
| Version |
Supported |
| Latest on npm |
✅ |
| Older major/minor |
❌ (upgrade recommended) |
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
- Use GitHub private vulnerability reporting if enabled, or
- Email the maintainers via the contact on the npm package page / repository owner profile.
Include:
- Description of the issue
- Steps to reproduce
- Impact (e.g. prototype pollution, ReDoS from malicious IGES input)
- Suggested fix (optional)
We aim to acknowledge within 5 business days and release a fix or advisory when appropriate.
Scope notes
This library parses text IGES files in user-controlled environments. Threat model includes:
- Malicious or enormous files causing excessive memory/CPU (denial of service)
- Untrusted inputs in server-side conversion pipelines
Not in scope: vulnerabilities in Three.js or your application code that merely uses this loader.