Thanks for your interest. samlguy is a focused tool for the IAM/identity community, so contributions that serve that audience are most welcome.
For anything beyond a small bug fix, open an issue first to discuss the change. This avoids wasted effort if the direction doesn't fit the project's scope.
Security vulnerabilities: do not open a public issue. See SECURITY.md for the disclosure process.
git clone https://github.com/kellenmurphy/samlguy.git
cd samlguy
npm install
npm run devRequires Node 20+.
- TypeScript strict mode — no
any, no type assertions without justification - Test coverage — all
src/lib/andsrc/routes/api/modules must maintain 100% statement, branch, function, and line coverage; runnpm run coverageto check - Lint —
npm run lintmust pass with no errors - Commit messages — follow Conventional Commits:
feat:,fix:,docs:,chore:, etc. Release notes are generated from commit messages.
- Fork the repo and create a branch from
main - Make your changes, add or update tests
- Run
npx tsc --noEmit && npm run lint && npm run coverage— all must pass - Open a pull request with a clear description of what changed and why
- All CI checks must pass before review
- Improvements to SAML, JWT, or X.509 parsing accuracy
- New identity protocol support (OIDC, WS-Fed, SCIM, etc.)
- Accessibility and usability improvements
- Documentation improvements
- Bug fixes
- General-purpose web app features unrelated to identity
- External service integrations that require sending token data off-device
- Changes that weaken the client-side-only privacy guarantee