The MayaUSD team and community take security bugs in maya-usd seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to Autodesk. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it.
We value those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures.
If you believe you have found a security vulnerability relating to the Autodesk's systems or products, please submit a vulnerability report to Autodesk HackerOne program or psirt@autodesk.com. Otherwise, submit a report an incident at Autodesk Trust Center.
In your report please include details of:

• The software package, website, IP or page where the vulnerability can be observed.
• A brief description of the type of vulnerability, for example; "XSS vulnerability".
• Steps to reproduce. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as sub-domain takeovers.

The MayaUSD team will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

We appreciate the responsible disclosure of security vulnerabilities. Please allow us a reasonable amount of time to address the issue before making it public.

To learn more about Autodesk Security, please see the Autodesk Trust Center.

Technical security information about our products and services is distributed through several channels.

• Autodesk distributes information to customers about security vulnerabilities via https://www.autodesk.com and Autodesk Trust Center.
• Autodesk may issue release notes and security bulletins detailing security vulnerabilities, workarounds, remediations and any indicators of compromise to aid incident response teams.