Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
48 lines (35 loc) · 1.61 KB

CONTRIBUTING.md

File metadata and controls

48 lines (35 loc) · 1.61 KB
Raw

Contributing to BeforeShip

Thanks for considering contributing.

BeforeShip is intended to be a practical, open-source launch gate for AI-built apps. Contributions should make it easier for solo founders to identify and fix real production risks before deploy.

Good first contributions

  • Add a detector for a common vibe-coded app failure
  • Add examples of flawed/fixed apps
  • Improve report language
  • Add framework-specific checks
  • Improve documentation
  • Add tests for detectors
  • Add MCP client setup examples

Contribution principles

  1. Prefer deterministic checks over LLM-only judgement.
  2. Explain findings in plain language. Solo founders should understand why an issue matters.
  3. Include evidence. Findings should point to files, routes, headers, or commands.
  4. Generate minimal fix plans. Avoid broad “rewrite the app” advice.
  5. Do not encourage offensive testing against third-party apps. BeforeShip is for apps you own or are authorized to audit.

Proposed detector format

Each detector should return findings shaped like:

{
  "id": "category.issue_id",
  "severity": "critical",
  "category": "payments",
  "title": "Human-readable title",
  "file": "path/to/file.ts",
  "evidence": "What was found",
  "why_it_matters": "Plain-English risk",
  "fix_prompt": "Agent-ready fix prompt"
}

Development setup

Implementation is not started yet. Once packages are added, this file will include local setup, test, lint, and release instructions.

Security

If you find a vulnerability in BeforeShip itself, please report it privately first. See SECURITY.md.