chore(community): add code of conduct, contributing guide, issue and PR templates

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug report
+about: Something decoded incorrectly or the tool broke
+labels: bug
+---
+
+**What happened?**
+A clear description of the bug.
+
+**Input type**
+- [ ] SAMLRequest
+- [ ] SAMLResponse
+- [ ] JWT
+- [ ] Other
+
+**Steps to reproduce**
+1. Paste ...
+2. See ...
+
+**Expected behavior**
+What did you expect to see?
+
+**Actual behavior**
+What did you see instead?
+
+**Environment**
+- Browser:
+- OS:
+
+**Additional context**
+If you can share a sanitized/redacted example of the input that triggers the bug, that helps a lot. Remove any real credentials, user data, or sensitive attribute values before pasting.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest something for the identity community
+labels: enhancement
+---
+
+**What problem does this solve?**
+Describe the IAM/identity workflow or use case this would improve.
+
+**Proposed solution**
+What would you like to see?
+
+**Alternatives considered**
+Any other approaches you thought about?
+
+**Additional context**
+Links to relevant specs (SAML, OIDC, etc.), screenshots, or examples welcome.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## What does this PR do?
+
+<!-- A short description of the change and why it's needed. -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Documentation update
+- [ ] Refactor / cleanup
+- [ ] Security improvement
+
+## Checklist
+
+- [ ] `npx tsc --noEmit` passes
+- [ ] `npm run lint` passes
+- [ ] `npm run coverage` passes with 100% coverage
+- [ ] Tests added or updated for any changed behavior
+- [ ] SECURITY.md updated if this affects security controls
+
+## Notes for reviewer
+
+<!-- Anything that would help the reviewer understand the change, trade-offs made, or areas to focus on. -->

CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+## Our pledge
+
+In the interest of fostering an open and welcoming environment, contributors and maintainers pledge to make participation in this project a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experience
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or advances
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the maintainer at **me@kellenmurphy.com**. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing to samlguy
+
+Thanks for your interest. samlguy is a focused tool for the IAM/identity community, so contributions that serve that audience are most welcome.
+
+## Before you start
+
+For anything beyond a small bug fix, open an issue first to discuss the change. This avoids wasted effort if the direction doesn't fit the project's scope.
+
+**Security vulnerabilities:** do not open a public issue. See [SECURITY.md](SECURITY.md) for the disclosure process.
+
+## Development setup
+
+```bash
+git clone https://github.com/kellenmurphy/samlguy.git
+cd samlguy
+npm install
+npm run dev
+```
+
+Requires Node 20+.
+
+## Standards
+
+- **TypeScript strict mode** — no `any`, no type assertions without justification
+- **Test coverage** — all `src/lib/` and `src/routes/api/` modules must maintain 100% statement, branch, function, and line coverage; run `npm run coverage` to check
+- **Lint** — `npm run lint` must pass with no errors
+- **Commit messages** — follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `chore:`, etc. Release notes are generated from commit messages.
+
+## Submitting a PR
+
+1. Fork the repo and create a branch from `main`
+2. Make your changes, add or update tests
+3. Run `npx tsc --noEmit && npm run lint && npm run coverage` — all must pass
+4. Open a pull request with a clear description of what changed and why
+5. All CI checks must pass before review
+
+## What fits this project
+
+- Improvements to SAML, JWT, or X.509 parsing accuracy
+- New identity protocol support (OIDC, WS-Fed, SCIM, etc.)
+- Accessibility and usability improvements
+- Documentation improvements
+- Bug fixes
+
+## What probably doesn't fit
+
+- General-purpose web app features unrelated to identity
+- External service integrations that require sending token data off-device
+- Changes that weaken the client-side-only privacy guarantee

README.md

@@ -111,7 +111,7 @@ src/
 
 ## Contributing
 
-This started as a personal passion project for [The SAML Guy](https://kellenmurphy.com) to mess with a nifty tech stack (Svelte). Bug reports and suggestions are welcome via [GitHub Issues](https://github.com/kellenmurphy/samlguy/issues). For security vulnerabilities, please follow the [responsible disclosure process](SECURITY.md) rather than opening a public issue.
+This started as a personal passion project for [The SAML Guy](https://kellenmurphy.com) to mess with a nifty tech stack (Svelte). Bug reports and suggestions are welcome via [GitHub Issues](https://github.com/kellenmurphy/samlguy/issues). See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and contribution guidelines. For security vulnerabilities, please follow the [responsible disclosure process](SECURITY.md) rather than opening a public issue.
 
 
 ## License