docs: complete the open-source community standards - #23
Merged
Merged
Conversation
GitHub's community profile sat at 57%: a code of conduct, a security policy, issue templates and a PR template were all missing. Adding them as templates would have been easy and useless, so each one carries the rules this repository actually has rather than the generic text. CODE_OF_CONDUCT.md — Contributor Covenant 2.1, plus one project-specific clause. A session recording is a full reconstruction of a page and everything that was on it, so publishing a real person's recording is treated as publishing their private information: a conduct matter, not a technical one. The existing rule against committing recordings covers this repository; it did not cover an issue comment with a file attached. SECURITY.md — private reporting route, and an explicit in-scope list, because the boundaries here are testable rather than aspirational: nothing from the model is executed (no-eval.test.ts greps the source and fails the build), every response has a budget, the recorder captures shapes and not values, and no committed recording is real. bugbait/ being broken on purpose is stated as out of scope so nobody files its wrong API responses as vulnerabilities. Issue templates — bug reports ask which WebMCP mode you were in, because the polyfill, the origin trial and the webmcp-tools inspector are three different execution paths and a bug in one often does not exist in the others. The tool proposal template asks why the page must compute the answer rather than a server, which is the question that decides most proposals. PR template — the three non-negotiable rules as checkboxes, since a reviewer cannot verify any of them by reading a diff, plus the tsc/test line that catches "it compiles on my machine". Also, from reading these files as a newcomer would: - git clone <this repo> was a placeholder in both README and CONTRIBUTING. It is now the real URL. - CONTRIBUTING's setup block said `cd bugbait` after `cd traces`, which fails from inside traces/. Fixed to `cd ../bugbait`, matching the README. - The video badge said "under 3 min", which describes the contest rule rather than the video. - Added the Devpost submission link, so the repository and the write-up point at each other. Verified: tsc --noEmit clean, 309 tests passing across 25 files, all three issue-template YAML files parse.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub's community profile was at 57% — code of conduct, security policy, issue templates and PR template all missing. Each new file carries this repository's actual rules rather than the generic template text.
New
CODE_OF_CONDUCT.mdSECURITY.mdbugbait/being broken on purpose is explicitly out of scope..github/ISSUE_TEMPLATE/bug_report.ymlwebmcp-toolsinspector are three different execution paths; a bug in one often doesn't exist in the others. Also asks you to describe rather than attach a recording you made yourself..github/ISSUE_TEMPLATE/tool_proposal.yml.github/ISSUE_TEMPLATE/config.yml.github/PULL_REQUEST_TEMPLATE.mdtsc --noEmit && npm testline.Fixed while reading these as a newcomer would
git clone <this repo>was a literal placeholder in both README and CONTRIBUTING. Now the real URL, withcd Traceson its own line.cd bugbaitaftercd traces, which fails from insidetraces/. Nowcd ../bugbait, matching the README.SECURITY.mdfor reporting, not only at the threat model for reading.Verification
No source files touched — docs, templates and two link fixes only.