Please report vulnerabilities privately through the repository's GitHub Security Advisory feature rather than opening a public issue.

3DFaceViewer is designed as a local-first application. Reports involving unexpected network access, renderer-to-filesystem privilege escalation, WebSocket origin bypass, unbounded model requests, or unsafe handling of image uploads are particularly important.

Only the latest source version is currently supported. Do not include personal face or iris images, credentials, or other sensitive data in a report.