From aa6c4027777985b8198b7881cd3abc5df8f48a88 Mon Sep 17 00:00:00 2001
From: mie <79989386+mahach666@users.noreply.github.com>
Date: Wed, 11 Nov 2026 14:45:48 +0300
Subject: [PATCH] chore: align repository with IOExtend standards

Bring documentation, CI and project settings in line with RvtIO.

- Generate the XML documentation file for the IOViewer package; the
  IsPackable condition in Directory.Build.props never matched.
- Run the release workflow only for version tags, fail on gh errors and
  stop overwriting assets of an existing release.
- Fail pack-release.ps1 when the source archive cannot be created.
- Remove claims of .mtl and mesh simplification support from the docs.
- Add the Autodesk trademark notice and use mahach666 as the copyright
  holder everywhere.
- Describe supported versions, security scope, development setup and
  the clean-room policy in SECURITY.md and CONTRIBUTING.md.
- Run tests on .NET 8 and .NET 10; pin SDK 10.0.100 without prerelease.
- Add NuGet audit, Dependabot, .gitattributes and issue/PR templates.
---
 .gitattributes                             | 13 +++
 .github/ISSUE_TEMPLATE/bug_report.md       | 19 +++++
 .github/ISSUE_TEMPLATE/feature_request.md  | 11 +++
 .github/PULL_REQUEST_TEMPLATE.md           |  8 ++
 .github/dependabot.yml                     | 10 +++
 .github/workflows/ci.yml                   | 14 ++--
 .github/workflows/docs.yml                 | 15 ++--
 .github/workflows/release.yml              | 28 ++-----
 CHANGELOG.md                               | 19 ++++-
 CONTRIBUTING.md                            | 96 +++++++++++++++++-----
 Directory.Build.props                      | 12 ++-
 LICENSE                                    |  2 +-
 README.md                                  |  9 +-
 SECURITY.md                                | 31 +++++--
 docs/index.md                              |  4 +-
 docs/public-api.md                         |  2 +-
 global.json                                |  5 +-
 src/IOViewer/IOViewer.csproj               |  1 +
 tests/IOViewer.Tests/IOViewer.Tests.csproj |  2 +-
 tools/pack-release.ps1                     |  3 +-
 20 files changed, 230 insertions(+), 74 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md
 create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md
 create mode 100644 .github/dependabot.yml

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..f7d3cd9
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+# Source and text files are stored and checked out with LF.
+* text=auto eol=lf
+
+# Fixtures and images are never normalised.
+*.glb binary
+*.gz binary
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.nupkg binary
+*.snupkg binary
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
new file mode 100644
index 0000000..2ea413f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,19 @@
+---
+name: Bug report
+about: A model is imported or displayed wrongly, or the tool fails
+labels: bug
+---
+
+**IOViewer version** (`ioviewer --version` or the package version):
+
+**Input format** (`.glb`, `.obj`, `.json` or a `ViewerDocument` built in code):
+
+**Browser and operating system** (for problems in the generated viewer):
+
+**Command line or API call** (remove confidential values and personal paths):
+
+**What you expected**:
+
+**What happened** (error messages, diagnostics from standard error, browser console errors):
+
+Please do not attach models with confidential content. A short description of the model is enough to start.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
new file mode 100644
index 0000000..59d2609
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,11 @@
+---
+name: Feature request
+about: Suggest an improvement
+labels: enhancement
+---
+
+**What do you want to do?**
+
+**What happens today?**
+
+**Which input formats or viewer features does it concern?**
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..47541a9
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,8 @@
+## What changes and why
+
+## How it was checked
+
+- [ ] `dotnet build IOViewer.slnx -c Release` has no warnings
+- [ ] `dotnet test IOViewer.slnx -c Release` passes
+- [ ] Generated HTML and JSON for the same inputs are unchanged, or the differences are listed and intended
+- [ ] No customer models, personal data, vendor code or third-party JavaScript is added
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a846233
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a44c497..cb23daf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,17 +16,17 @@ jobs:
         os: [windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
+          global-json-file: global.json
           dotnet-version: |
             8.0.x
-            10.0.x
       - run: dotnet restore IOViewer.slnx
       - run: dotnet build IOViewer.slnx -c Release --no-restore
       - run: dotnet test IOViewer.slnx -c Release --no-build
       - run: dotnet pack IOViewer.slnx -c Release --no-build -o artifacts
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: packages-${{ matrix.os }}
           path: artifacts/*.nupkg
@@ -35,10 +35,10 @@ jobs:
   build-linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
+          global-json-file: global.json
           dotnet-version: |
             8.0.x
-            10.0.x
       - run: dotnet build src/IOViewer.Cli/IOViewer.Cli.csproj -c Release
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 54ffb45..df55576 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -29,16 +29,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: |
-            8.0.x
-            10.0.x
+          global-json-file: global.json
       - run: dotnet tool restore
       - run: dotnet docfx docfx.json --warningsAsErrors
-      - run: rm -f _site/manifest.json
-      - uses: actions/upload-pages-artifact@v4
+      # manifest.json records the build machine paths and is not part of the site.
+      - run: rm _site/manifest.json
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: _site
 
@@ -54,4 +53,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55b1b87..df37d82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,7 +3,6 @@ name: Release
 on:
   push:
     tags: ['v*']
-  workflow_dispatch:
 
 permissions:
   contents: write
@@ -13,9 +12,10 @@ jobs:
   publish:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
+          global-json-file: global.json
           dotnet-version: |
             8.0.x
             10.0.x
@@ -24,7 +24,7 @@ jobs:
         run: |
           $version = dotnet msbuild src/IOViewer/IOViewer.csproj -getProperty:Version -nologo
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          if ($env:GITHUB_REF_NAME -and $env:GITHUB_REF_NAME.StartsWith("v") -and $env:GITHUB_REF_NAME -cne "v$($version.Trim())") {
+          if ($env:GITHUB_REF_NAME -cne "v$($version.Trim())") {
             throw "The release tag must match the package version v$($version.Trim())."
           }
       - run: dotnet restore IOViewer.slnx
@@ -33,16 +33,16 @@ jobs:
       - name: Pack release
         shell: pwsh
         run: ./tools/pack-release.ps1
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: packages
           path: artifacts/*
-      - name: Create or update release
+      - name: Create release
         shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          $version = if ($env:GITHUB_REF_NAME -and $env:GITHUB_REF_NAME.StartsWith("v")) { $env:GITHUB_REF_NAME.Substring(1) } else { (dotnet msbuild src/IOViewer/IOViewer.csproj -getProperty:Version -nologo).Trim() }
+          $version = $env:GITHUB_REF_NAME.Substring(1)
           $changelog = Get-Content -LiteralPath CHANGELOG.md -Encoding utf8
           $start = [array]::FindIndex($changelog, [Predicate[string]] { param($line) $line.StartsWith("## [$version]") })
           if ($start -lt 0) { throw "CHANGELOG.md has no entry for $version" }
@@ -50,18 +50,8 @@ jobs:
           for ($i = $start + 1; $i -lt $changelog.Count -and -not $changelog[$i].StartsWith('## ['); $i++) { $notes += $changelog[$i] }
           $notes | Set-Content -LiteralPath release-notes.md -Encoding utf8
           $files = @(Get-ChildItem artifacts -File | ForEach-Object { $_.FullName })
-          $tagName = if ($env:GITHUB_REF_NAME -and $env:GITHUB_REF_NAME.StartsWith("v")) { $env:GITHUB_REF_NAME } else { "v$version" }
-          
-          # Check if release exists
-          $exists = gh release view $tagName 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "Updating existing release $tagName..."
-            gh release edit $tagName --notes-file release-notes.md
-            gh release upload $tagName @files --clobber
-          } else {
-            Write-Host "Creating release $tagName..."
-            gh release create $tagName @files --title "IOViewer v$version" --notes-file release-notes.md
-          }
+          gh release create $env:GITHUB_REF_NAME --title $env:GITHUB_REF_NAME --notes-file release-notes.md @files
+          if ($LASTEXITCODE -ne 0) { throw "gh release create failed with exit code $LASTEXITCODE" }
       # Trusted publishing: the NuGet policy for this repository and workflow file exchanges the GitHub OIDC token for a short-lived key.
       - uses: NuGet/login@v1
         id: nuget-login
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7f0137..462897a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,23 @@
 # Changelog
 
-All notable changes to the `IOViewer` library and CLI are documented in this file.
+All notable changes are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html); versions before 1.0 may change the
+API between minor releases.
+
+## [Unreleased]
+
+### Fixed
+- The `IOViewer` package now includes the XML documentation file, so existing API comments show in IntelliSense.
+- The release workflow runs only for version tags again, fails on any `gh release` error and no longer overwrites assets of an existing release.
+- `tools/pack-release.ps1` fails when creating the source archive fails.
+- Documentation no longer claims `.mtl` material support or mesh simplification, neither of which exists.
+
+### Changed
+- Tests run on both .NET 8 and .NET 10.
+- `global.json`, CI workflows and repository settings follow the shared IOExtend conventions: SDK 10.0.100 without prerelease, NuGet vulnerability audit, Dependabot, LF line endings, issue and pull request templates.
+- Copyright holder is `mahach666` in the license, package metadata and README.
+- README and documentation state that IOViewer is not affiliated with Autodesk.
+- `SECURITY.md` and `CONTRIBUTING.md` describe supported versions, security scope, development setup and the clean-room policy.
 
 ## [0.1.0] - 2026-11-11
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 77e95fa..4c2fb99 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,31 +1,89 @@
 # Contributing to IOViewer
 
-## Reporting Bugs
+## Reporting bugs
 
 Open a [GitHub issue](https://github.com/IOExtend/IOViewer/issues) with:
-- The `IOViewer` / `ioviewer` version.
-- The command line or C# API call used, with confidential or personal paths removed.
-- A minimal description of how to reproduce the issue.
-- Expected and actual results, including relevant error messages or stack traces.
 
-Do not attach proprietary models if they contain confidential or customer data.
+- The IOViewer version (`ioviewer --version` or the package version).
+- The command line or API call used, with confidential values and personal paths removed.
+- A minimal description of how to reproduce the problem.
+- Expected and actual results, including relevant error messages.
 
-Report security vulnerabilities privately through the **Security** tab.
+Do not attach models if they contain confidential or customer data.
+A minimal description is better than sharing a confidential model.
 
-## Code Conventions & Clean-Room Policy
+Report security issues through GitHub private vulnerability reporting in
+the Security tab. Do not open public issues for security vulnerabilities.
 
-- **Clean-Room Development**: All code must be independently authored without decompiled proprietary source code, proprietary headers, or vendor SDKs.
-- Do not commit proprietary project data or third-party binaries to the repository.
-- Keep nullable reference types enabled (`<Nullable>enable</Nullable>`).
-- Warnings are treated as errors (`<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`).
-- Zero native or third-party library dependencies for core HTML generation and exporting functionality.
+## Proposing changes
 
-## Releases & NuGet Publishing
+Open an issue first for larger changes so the scope and approach can be
+discussed before implementation. Keep changes focused on the agreed problem.
 
-Push a tag matching the package version, such as `v0.1.0`, to trigger the `release.yml` workflow.
-The workflow builds and tests the solution, packs release packages and symbols, generates archives with checksums, publishes the GitHub Release, and publishes packages to NuGet.org via Trusted Publishing (GitHub Actions OIDC).
-The NuGet policy on NuGet.org must name this repository (`IOExtend/IOViewer`), workflow `release.yml`, publisher `GitHubActions`, package pattern `IOViewer*`, and owner `mahach`.
+## Development setup
 
-## Licensing Contributions
+Install the .NET SDK specified by `global.json`. It currently specifies
+10.0.100, allows roll-forward to the latest feature band, and excludes
+prerelease SDKs. Tests run on .NET 8 and .NET 10, so both runtimes are needed.
 
-All contributions are licensed under the [MIT License](LICENSE). By submitting a pull request, you confirm that you have the right to contribute your code under that license.
+From the repository root, run:
+
+```sh
+dotnet build IOViewer.slnx -c Release
+dotnet test IOViewer.slnx -c Release
+```
+
+The library is in `src/IOViewer`, the CLI in `src/IOViewer.Cli`, and tests in
+`tests/IOViewer.Tests`. Tests use small synthetic models built in code.
+The repository ships no customer models.
+
+## Clean-room policy
+
+- Write all code independently. Do not use decompiled or leaked source code,
+  proprietary headers, vendor SDKs or code copied from other viewers.
+- Do not add third-party JavaScript to the generated HTML. The viewer runs on
+  plain WebGL and must stay self-contained and offline.
+- Do not add customer models, confidential data, vendor files or binaries to
+  the repository. Keep private test files outside version control.
+- Do not put personal data in code, documentation, test data or commit
+  metadata. Use your GitHub noreply address as the commit email.
+
+## Code conventions
+
+- Follow the surrounding code and repository formatting settings.
+- Keep nullable reference types enabled.
+- Warnings are treated as errors.
+- Write short English comments that explain why.
+- Document new and changed public APIs with XML documentation comments.
+- Do not write console output from the library. Only the CLI writes to the
+  console, with diagnostics on standard error.
+- Do not add runtime dependencies to the library without discussing it first.
+
+## Pull requests
+
+Include:
+
+- A description of the problem and the change.
+- Tests for behavior changes, including relevant errors and edge cases.
+- The build and test commands run, their results, and any skipped checks.
+- A note on how the generated HTML changes when the viewer template is affected.
+
+Write commit messages in the imperative mood, for example,
+"Fix section box clipping on rotated models".
+
+## Releases
+
+Push a tag matching the package version, such as `v0.2.0`, to run `release.yml`.
+The workflow builds and tests the solution, attaches packages, symbols, source and checksums to a GitHub release,
+and publishes the NuGet packages through Trusted Publishing. The release notes are the section of `CHANGELOG.md` for the version, so add that section before the tag.
+The NuGet policy must name this repository, `release.yml`, the configured NuGet profile and the `IOViewer*` package pattern.
+
+## Licensing contributions
+
+Contributions are licensed under the MIT license. By submitting a
+contribution, you confirm that you have the right to contribute it under
+that license.
+
+## Questions
+
+Ask questions in GitHub Discussions or repository issues.
diff --git a/Directory.Build.props b/Directory.Build.props
index 22c6122..a543d01 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -16,7 +16,7 @@
   <PropertyGroup>
     <Version>0.1.0</Version>
     <Authors>mahach666</Authors>
-    <Copyright>Copyright (c) 2026 IOExtend</Copyright>
+    <Copyright>Copyright (c) 2026 mahach666</Copyright>
     <Product>IOViewer</Product>
     <Description>Fast, pure managed .NET library and CLI tool for generating standalone, zero-dependency interactive 3D WebGL/HTML BIM &amp; CAD model viewers.</Description>
     <NeutralLanguage>en</NeutralLanguage>
@@ -24,7 +24,7 @@
     <PackageProjectUrl>https://github.com/IOExtend/IOViewer</PackageProjectUrl>
     <RepositoryUrl>https://github.com/IOExtend/IOViewer</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
-    <PackageTags>bim;cad;webgl;html-viewer;3d-viewer;threejs;revit;ifc;navisworks;gltf;glb;obj;timeliner;4d;viewcube;section-box;measure;grids</PackageTags>
+    <PackageTags>bim;cad;webgl;html-viewer;3d-viewer;revit;ifc;navisworks;gltf;glb;obj;timeliner;4d;viewcube;section-box;measure;grids</PackageTags>
     <PackageReadmeFile>README.md</PackageReadmeFile>
     <PackageIcon>icon.png</PackageIcon>
   </PropertyGroup>
@@ -35,13 +35,19 @@
   </ItemGroup>
 
   <PropertyGroup Condition="'$(MSBuildProjectExtension)' == '.csproj'">
-    <GenerateDocumentationFile Condition="'$(IsPackable)' == 'true'">true</GenerateDocumentationFile>
     <NoWarn>$(NoWarn);CS1591</NoWarn>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <AnalysisLevel>latest-recommended</AnalysisLevel>
   </PropertyGroup>
 
+  <!-- Report known-vulnerable packages, direct and transitive, as warnings (NU1901-NU1904). -->
+  <PropertyGroup>
+    <NuGetAudit>true</NuGetAudit>
+    <NuGetAuditMode>all</NuGetAuditMode>
+    <NuGetAuditLevel>low</NuGetAuditLevel>
+  </PropertyGroup>
+
   <PropertyGroup Condition="'$(CI)' == 'true' Or '$(GITHUB_ACTIONS)' == 'true' Or '$(TF_BUILD)' == 'true'">
     <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
   </PropertyGroup>
diff --git a/LICENSE b/LICENSE
index adefd9a..a79c677 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 IOViewer contributors
+Copyright (c) 2026 mahach666
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
index 8fc9822..0ec0eef 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://opensource.org/licenses/MIT)
 [![Platform](https://img.shields.io/badge/.NET-8.0%20%7C%2010.0-512BD4?style=flat-square&logo=dotnet)](https://dotnet.microsoft.com/)
 
-IOViewer is a fast, 100% managed .NET library and command line tool that generates standalone, zero-dependency interactive 3D WebGL / HTML BIM & CAD model viewers from code, glTF/GLB, Wavefront OBJ, JSON, or sibling libraries ([RvtIO](https://github.com/IOExtend/RvtIO), [IfcIO](https://github.com/IOExtend/IfcIO), and [NwcIO](https://github.com/IOExtend/NwcIO)).
+IOViewer is a fast, 100% managed .NET library and command line tool that generates standalone, zero-dependency interactive 3D WebGL / HTML BIM & CAD model viewers from code, glTF/GLB, Wavefront OBJ, or JSON. Geometry read by sibling libraries ([RvtIO](https://github.com/IOExtend/RvtIO), [IfcIO](https://github.com/IOExtend/IfcIO), and [NwcIO](https://github.com/IOExtend/NwcIO)) can be passed in by building a `ViewerDocument` in code; IOViewer has no direct dependency on them.
 
 The generated HTML file is completely self-contained, offline-ready, and works in any modern browser without external servers or cloud dependencies.
 
@@ -128,11 +128,12 @@ The documentation site with API references and guides is at <https://ioextend.gi
 ## Limitations
 
 - Version 0.1.0 is an initial release. The API can evolve before 1.0.
-- Standalone HTML export generates self-contained files (assets inlined in HTML). Extremely large assemblies with millions of triangles should be exported with LOD simplification.
+- Standalone HTML export generates self-contained files with all geometry inlined. IOViewer does not simplify meshes, so models with millions of triangles produce large files; reduce them before export.
+- The OBJ importer reads geometry only; `.mtl` material files are not read.
 
 ## Build from source and tests
 
-Use the .NET SDK selected by `global.json`, which specifies 10.0.100 with `latestFeature` roll-forward.
+Use the .NET SDK selected by `global.json`, which specifies 10.0.100 with `latestFeature` roll-forward and excludes prerelease SDKs.
 
 From the repository root:
 
@@ -152,3 +153,5 @@ Report vulnerabilities through GitHub private vulnerability reporting in the rep
 ## License and trademarks
 
 IOViewer is licensed under the [MIT License](LICENSE). Copyright holder: mahach666.
+
+IOViewer is not affiliated with, endorsed by or sponsored by Autodesk. Autodesk, Revit, Navisworks, ViewCube and TimeLiner are trademarks of Autodesk, Inc. They are used here only to describe compatibility and familiar features. The viewer is written from scratch and includes no Autodesk code or binaries.
diff --git a/SECURITY.md b/SECURITY.md
index bf302ea..4fa544f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,10 +1,27 @@
-# Security Policy
+# Security policy
 
-## Reporting a Vulnerability
+## Supported versions
 
-Report security vulnerabilities through GitHub private vulnerability reporting:
-1. Go to the **Security** tab of this repository.
-2. Select **Report a vulnerability**.
-3. Describe the vulnerability, its potential impact, and clear steps to reproduce.
+IOViewer is in preview (0.x). Security fixes are made on the latest release only.
 
-Do not report security issues or sensitive data through public GitHub issues.
+## Reporting a vulnerability
+
+Please do not open a public issue for a security problem. Use GitHub private vulnerability reporting:
+open the Security tab of the repository and choose "Report a vulnerability". Include the version of IOViewer, the
+command or API call, and a description of the problem. A sample file that triggers it helps, but do not send files
+with confidential content.
+
+You can expect an acknowledgement within a few days. Fixes are released as soon as they are verified, and the report
+is credited unless you prefer otherwise.
+
+## Scope
+
+IOViewer reads files that can come from untrusted sources and writes HTML that is opened in a browser. Problems that
+matter most:
+
+- crashes, hangs or unbounded memory use caused by a crafted `.glb`, `.obj` or `.json` file;
+- script injection into the generated HTML through model names, properties or other text taken from the input;
+- writing files outside the path a command was given;
+- the `--serve` preview server exposing files other than the generated viewer, or listening beyond the local machine;
+- any other behaviour of the library that executes code or contacts the network (the library does neither; only the
+  CLI `--serve` option opens a local HTTP server).
diff --git a/docs/index.md b/docs/index.md
index 384ec65..83f6aae 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -4,7 +4,7 @@ title: IOViewer
 
 # IOViewer
 
-**IOViewer** is a fast, 100% managed .NET library and CLI tool for generating standalone, zero-dependency interactive 3D WebGL / HTML BIM & CAD model viewers directly from code or file formats (glTF/GLB, Wavefront OBJ, JSON, and IOExtend models).
+**IOViewer** is a fast, 100% managed .NET library and CLI tool for generating standalone, zero-dependency interactive 3D WebGL / HTML BIM & CAD model viewers directly from code or file formats (glTF/GLB, Wavefront OBJ, and JSON).
 
 The generated HTML file is completely self-contained, offline-ready, and works in any modern desktop or mobile browser without requiring external servers, WebGL plug-ins, or cloud connectivity.
 
@@ -26,3 +26,5 @@ The generated HTML file is completely self-contained, offline-ready, and works i
 - [Getting started](getting-started.md): install the package or CLI tool and generate your first 3D viewer.
 - [Public API](public-api.md): supported surface and key entry points of the library.
 - [Source on GitHub](https://github.com/IOExtend/IOViewer).
+
+IOViewer is not affiliated with, endorsed by or sponsored by Autodesk. Autodesk, Revit, Navisworks, ViewCube and TimeLiner are trademarks of Autodesk, Inc.
diff --git a/docs/public-api.md b/docs/public-api.md
index cc55566..e2291a0 100644
--- a/docs/public-api.md
+++ b/docs/public-api.md
@@ -25,5 +25,5 @@
 ### Importers (`IOViewer.Importers`)
 
 - `GlbViewerImporter`: Reads binary glTF 2.0 (`.glb`) files into `ViewerDocument`.
-- `ObjViewerImporter`: Reads Wavefront OBJ and MTL files into `ViewerDocument`.
+- `ObjViewerImporter`: Reads Wavefront OBJ geometry into `ViewerDocument`. Material (`.mtl`) files are not read.
 - `JsonViewerImporter`: Reads JSON document snapshots into `ViewerDocument`.
diff --git a/global.json b/global.json
index 163a6e1..d46d21e 100644
--- a/global.json
+++ b/global.json
@@ -1,6 +1,7 @@
 {
   "sdk": {
-    "version": "10.0.401",
-    "rollForward": "latestFeature"
+    "version": "10.0.100",
+    "rollForward": "latestFeature",
+    "allowPrerelease": false
   }
 }
diff --git a/src/IOViewer/IOViewer.csproj b/src/IOViewer/IOViewer.csproj
index 410268b..d974f1f 100644
--- a/src/IOViewer/IOViewer.csproj
+++ b/src/IOViewer/IOViewer.csproj
@@ -3,6 +3,7 @@
   <PropertyGroup>
     <IsPackable>true</IsPackable>
     <PackageId>IOViewer</PackageId>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
   </PropertyGroup>
 
   <ItemGroup>
diff --git a/tests/IOViewer.Tests/IOViewer.Tests.csproj b/tests/IOViewer.Tests/IOViewer.Tests.csproj
index becdb51..f98dd62 100644
--- a/tests/IOViewer.Tests/IOViewer.Tests.csproj
+++ b/tests/IOViewer.Tests/IOViewer.Tests.csproj
@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>net10.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
     <IsPackable>false</IsPackable>
     <NoWarn>$(NoWarn);CA1707</NoWarn>
   </PropertyGroup>
diff --git a/tools/pack-release.ps1 b/tools/pack-release.ps1
index 94e4a61..669fd36 100644
--- a/tools/pack-release.ps1
+++ b/tools/pack-release.ps1
@@ -65,7 +65,8 @@ New-Zip $cliNet10 (Join-Path $Output "IOViewer-Cli-$version-net10.0.zip")
 Write-Host "Archiving repository source tree..."
 $sourceZip = Join-Path $Output "IOViewer-$version-source.zip"
 if (Test-Path -LiteralPath $sourceZip) { Remove-Item -LiteralPath $sourceZip }
-git archive --format=zip --prefix="IOViewer-$version/" HEAD -o $sourceZip
+& git -C $root archive --format=zip --prefix="IOViewer-$version/" --output=$sourceZip HEAD
+if ($LASTEXITCODE -ne 0) { throw "git archive failed with exit code $LASTEXITCODE" }
 
 # 5. Pack NuGet Packages
 Write-Host "Packing NuGet packages..."