Security fixes are made on main and released on the current 3.x line. Older 2.x packages and the historical upstream package line are not maintained by this project.

Use GitHub's private vulnerability reporting flow:

https://github.com/taucad/opencascade.js/security/advisories/new

Include the affected package or image version, runtime, reproduction steps, impact, and any proposed mitigation. Do not include secrets or sensitive customer data, and do not open a public issue until a fix and disclosure plan have been coordinated.