MVG is a local asset compiler and renderer. Please report suspected security issues privately rather than including exploit details in a public issue.

Use GitHub's private vulnerability reporting for this repository when it is available. If private reporting is not enabled, open a minimal public issue requesting a private disclosure channel; do not include the vulnerability details in that issue.

Reports should identify the affected MVG version or commit, provide a minimal reproduction when safe to do so, and describe the expected security impact.