Thank you for helping build careful, reviewable open-source security infrastructure for AI agents.
The project ecosystem is currently in its foundation stage. Architecture feedback, threat models, documentation improvements, reproducible research proposals, and community-policy corrections are welcome. Product source repositories will open separately when their security boundaries and release contracts are ready.
- Check the target repository's README, issues, and security policy.
- Search for an existing discussion or issue before opening a duplicate.
- Open an issue for substantial architecture, API, data, or policy changes before writing a large patch.
- Report vulnerabilities privately. Never include exploit details, credentials, sensitive logs, or private data in a public issue.
- Make the security assumption and threat model explicit.
- Distinguish implemented behavior from planned behavior.
- Prefer reproducible evidence over marketing claims.
- Keep changes focused and explain meaningful trade-offs.
- Include tests or validation steps when behavior changes.
- Document data provenance, licensing, and collection constraints.
- Do not submit proprietary code, confidential material, real credentials, personal data, or content you are not authorized to publish.
A useful pull request includes:
- a clear problem statement and scope;
- the security impact and relevant threat model;
- implementation or documentation notes;
- validation performed and remaining limitations;
- linked issues or prior design discussion when applicable.
Use concise commit messages such as:
docs: clarify runtime trust boundaries
feat: add policy decision interface
test: cover delegated tool authority
Maintainers may ask to split unrelated changes, remove sensitive content, add evidence, or revise claims before review.
Research artifacts must describe methodology, limitations, evaluation conditions, and conflicts of interest. Dataset proposals must also document provenance, consent or lawful basis, intended use, known biases, license, and a removal process. Do not upload datasets until the relevant repository explicitly accepts them.
Contributors remain responsible for every submitted line. Review generated content for correctness, licensing, security defects, fabricated citations, and accidental disclosure. State material use of generated code or research content when it affects reviewability or provenance.
Participation is governed by the Code of Conduct. Security concerns follow the Security Policy.