Please do not open a public GitHub issue for security vulnerabilities. Send a confidential report to support@kernelcad.com, with the subject Security report: kernelCAD.

Include the affected component and version or URL, reproducible steps, observed impact, and a safe proof of concept if available. Do not include credentials, access tokens, personal customer data or live exploitation logs. The team can ask for additional details and coordinate disclosure after triage.

For ordinary bugs, use GitHub Issues.

Security fixes are targeted at the latest maintained release and current hosted service. Older versions may need to upgrade. Review releases before reporting an issue already addressed in a newer version.

The open-source CAD engine, CLI, local MCP server and headless viewer live in this repository. The hosted Studio and remote MCP service are maintained separately, but reports about either can be sent to the same contact.

Please test only systems and accounts you own or are explicitly permitted to test. Avoid service disruption and unnecessary access to other people's data.