3d-tools/SECURITY.md

Security policy

Report vulnerabilities privately to the repository owner. Supported version: 0.2.x.

3D Tools makes no uploads, telemetry or third-party requests. OBJ, STL, PLY and glTF/GLB files are treated as untrusted data under documented byte, JSON, geometry and scene-graph bounds. Parsing runs in a disposable worker, and revision-scoped results prevent cancelled or superseded jobs from replacing newer state.

External glTF resources are rejected, data URIs are decoded locally, and OBJ material-library references are never fetched. Imported text cannot become HTML, JavaScript or shader source. WebGL receives finite numeric arrays and fixed application-owned shaders; a preview failure does not block inspection, repair or export.