goifc parses IFC/STEP files supplied by third parties — a modeller, a client, an upload. The file is the untrusted input; the caller is not the adversary.

Against that model:

• A panic, a hang, or unbounded memory growth on a malformed file is a vulnerability. Consumers run this on files they did not author, often in a shared worker, so a crafted file that takes the process down is a denial of service. The parse and geometry paths carry explicit recursion guards and are fuzzed (make fuzz) for exactly this reason.
• A wrong quantity is a bug, not a vulnerability. Please open an issue.

One limitation worth stating plainly rather than leaving to be discovered: the guards bound recursion DEPTH, not total allocation or run time. A small file that expands into a very large tessellation is not currently bounded. If you have a case where that matters, we would rather hear about it.

Please report security vulnerabilities privately via GitHub Security Advisories for this repository, rather than opening a public issue.

Include as much detail as you can: the affected version, a minimal reproduction (ideally an IFC/STEP fragment that triggers the issue), and the impact you believe it has.

There is no guaranteed response time or support SLA. This is maintained on a best-effort basis.