Do not open public issues for vulnerabilities. Use GitHub's private vulnerability reporting for taucad/libassimp.

Supported releases are the latest stable version. Reports should include the affected version, host, reproduction, and expected impact. Maintainers will acknowledge a report, coordinate a fix, and publish through the normal signed CI release pipeline.