This is a client-side Unity library with no network, storage, or authentication surface of its own. The realistic risk area is a malformed asset (a prefab, model, or texture) that crashes the Unity importer or the runtime renderer.

Please report anything you believe is exploitable privately, not as a public issue:

• Open a private advisory via the repository's Security tab (Report a vulnerability), or
• Reach out to @sinanata.

I will acknowledge the report and, if it is valid, fix it on main and credit you unless you prefer otherwise.

The latest release on main is the only supported version. Fixes land there first.