Skip to content

Commit db89198

Browse files
mohammadumar-devmohammadumar-dev
committed
chore: add security, contribution, and community guidelines
Introduce project governance and community documentation to support secure, responsible, and collaborative development. This commit adds: - SECURITY.md defining vulnerability reporting and responsible disclosure - CODE_OF_CONDUCT.md establishing community behavior standards - CONTRIBUTING.md outlining contribution workflow and expectations - SUPPORT.md describing how users can get help and report issues These additions improve project maturity, clarify contributor expectations, and align the repository with open-source best practices without impacting runtime behavior or public APIs.
1 parent e9ac73b commit db89198

File tree

4 files changed

+505
-0
lines changed

4 files changed

+505
-0
lines changed

‎CODE_OF_CONDUCT.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
## Code of Conduct
2+
3+
### Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to make participation in this project
7+
and our community a harassment‑free experience for everyone, regardless of
8+
age, body size, disability, ethnicity, level of experience, education,
9+
socio‑economic status, nationality, personal appearance, race, religion, or
10+
sexual identity and orientation.
11+
12+
This Code of Conduct is inspired by the
13+
Contributor Covenant (version 2.1).
14+
15+
---
16+
17+
### Our Standards
18+
19+
Examples of behavior that contributes to creating a positive environment
20+
include:
21+
22+
- Using welcoming and inclusive language.
23+
- Being respectful of differing viewpoints and experiences.
24+
- Gracefully accepting constructive criticism.
25+
- Focusing on what is best for the community.
26+
- Showing empathy towards other community members.
27+
28+
Examples of unacceptable behavior include:
29+
30+
- The use of sexualized language or imagery and unwelcome sexual attention
31+
or advances.
32+
- Trolling, insulting or derogatory comments, and personal or political
33+
attacks.
34+
- Public or private harassment.
35+
- Publishing others’ private information, such as a physical or email
36+
address, without their explicit permission.
37+
- Other conduct which could reasonably be considered inappropriate in a
38+
professional setting.
39+
40+
---
41+
42+
### Our Responsibilities
43+
44+
Project maintainers are responsible for clarifying the standards of
45+
acceptable behavior and are expected to take appropriate and fair
46+
corrective action in response to any instances of unacceptable behavior.
47+
48+
Project maintainers have the right and responsibility to remove, edit, or
49+
reject comments, commits, code, wiki edits, issues, and other
50+
contributions that are not aligned to this Code of Conduct, or to ban
51+
temporarily or permanently any contributor for other behaviors that they
52+
reasonably deem inappropriate, threatening, offensive, or harmful.
53+
54+
---
55+
56+
### Scope
57+
58+
This Code of Conduct applies within all project spaces and also applies
59+
when an individual is officially representing the project or its community
60+
in public spaces. Examples of representing a project or community include
61+
using an official project email address, posting via an official social
62+
media account, or acting as an appointed representative at an online or
63+
offline event.
64+
65+
---
66+
67+
### Enforcement
68+
69+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
70+
reported to the project maintainer at:
71+
72+
- **Email**: `mohammadumar.dev@gmail.com`
73+
74+
All complaints will be reviewed and investigated and will result in a
75+
response that is deemed necessary and appropriate to the circumstances.
76+
The project team is obligated to maintain confidentiality with regard to
77+
the reporter of an incident. Further details of specific enforcement
78+
policies may be posted separately.
79+
80+
Project maintainers who do not follow or enforce the Code of Conduct in
81+
good faith may face temporary or permanent repercussions as determined by
82+
other members of the project’s leadership (if applicable).
83+
84+
---
85+
86+
### Enforcement Guidelines
87+
88+
Maintainers may use the following community impact guidelines to determine
89+
the consequences for any action they deem in violation of this Code of
90+
Conduct:
91+
92+
- **Correction**
93+
- *Community Impact*: Use of inappropriate language or other behavior
94+
deemed unprofessional or unwelcome in the community.
95+
- *Consequence*: A private, written warning from project maintainers,
96+
providing clarity around the nature of the violation and an
97+
explanation of why the behavior was inappropriate.
98+
99+
- **Warning**
100+
- *Community Impact*: A violation through a single incident or series of
101+
actions.
102+
- *Consequence*: A warning with consequences for continued behavior. No
103+
interaction with the people involved, including unsolicited
104+
interaction with those enforcing the Code of Conduct, for a specified
105+
period of time. This includes avoiding interactions in project spaces
106+
as well as external channels like social media.
107+
108+
- **Temporary Ban**
109+
- *Community Impact*: A serious violation of community standards,
110+
including sustained inappropriate behavior.
111+
- *Consequence*: A temporary ban from any sort of interaction or public
112+
communication with the community for a specified period of time.
113+
114+
- **Permanent Ban**
115+
- *Community Impact*: Demonstrating a pattern of violation of community
116+
standards, including sustained inappropriate behavior, harassment of
117+
an individual, or aggression toward or disparagement of classes of
118+
individuals.
119+
- *Consequence*: A permanent ban from any sort of public interaction
120+
within the community.
121+
122+
---
123+
124+
### Attribution
125+
126+
This Code of Conduct is adapted from the
127+
[Contributor Covenant](https://www.contributor-covenant.org),
128+
version 2.1.
129+
130+
For answers to common questions about this code of conduct, see the FAQ at
131+
`https://www.contributor-covenant.org/faq`. Translations are available at
132+
`https://www.contributor-covenant.org/translations`.
133+

‎CONTRIBUTING.md‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
## Contributing to `passkeys-cli`
2+
3+
Thank you for your interest in contributing! This document explains how to
4+
set up your environment, propose changes, and follow the project’s
5+
conventions.
6+
7+
---
8+
9+
### Code of Conduct
10+
11+
By participating in this project, you agree to abide by the
12+
[`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md). Please read it before
13+
opening issues or pull requests.
14+
15+
---
16+
17+
### Getting Started
18+
19+
- **Prerequisites**
20+
- Python 3.10+ (or the version specified in `README.md` if different).
21+
- `git` installed and configured.
22+
23+
- **Fork & Clone**
24+
- Fork the repository on GitHub.
25+
- Clone your fork:
26+
27+
```bash
28+
git clone https://github.com/<your-username>/passkeys-cli.git
29+
cd passkeys-cli
30+
```
31+
32+
- **Create a virtual environment** (recommended):
33+
34+
```bash
35+
python -m venv .venv
36+
source .venv/bin/activate # On Windows: .venv\Scripts\activate
37+
```
38+
39+
- **Install dependencies**:
40+
41+
```bash
42+
pip install --upgrade pip
43+
pip install -r requirements.txt
44+
```
45+
46+
---
47+
48+
### Running the Project
49+
50+
The main entry point of the CLI is typically `main.py`. For local
51+
development, you can run:
52+
53+
```bash
54+
python main.py --help
55+
```
56+
57+
Refer to `README.md` for more detailed usage examples and options.
58+
59+
---
60+
61+
### How to Contribute
62+
63+
- **Bug reports**
64+
- Check existing GitHub issues to avoid duplicates.
65+
- When opening a new issue, include:
66+
- Clear description of the problem.
67+
- Steps to reproduce.
68+
- Expected vs. actual behavior.
69+
- Environment details (OS, Python version, `passkeys-cli` version).
70+
71+
- **Feature requests**
72+
- Explain the use case and why it belongs in `passkeys-cli`.
73+
- Consider the project’s scope: passkey/credential management via CLI.
74+
75+
- **Small changes**
76+
- For documentation tweaks, typo fixes, or small code changes, you can
77+
open a pull request directly.
78+
79+
- **Larger changes**
80+
- For significant behavior changes or new features, open an issue first
81+
to discuss the idea before investing a lot of time in an
82+
implementation.
83+
84+
---
85+
86+
### Development Workflow
87+
88+
1. **Create a branch** from `main`:
89+
90+
```bash
91+
git checkout -b feature/my-new-feature
92+
```
93+
94+
2. **Make your changes** in focused, logical commits.
95+
96+
3. **Run tests / checks** (if test suite or linting is defined in this
97+
project, please run it before opening a PR).
98+
99+
4. **Commit with a meaningful message**:
100+
101+
```bash
102+
git commit -am "Add support for X in Y"
103+
```
104+
105+
5. **Push your branch**:
106+
107+
```bash
108+
git push origin feature/my-new-feature
109+
```
110+
111+
6. **Open a Pull Request (PR)** against the `main` branch.
112+
113+
---
114+
115+
### Coding Guidelines
116+
117+
To keep the codebase consistent and maintainable:
118+
119+
- **Style**
120+
- Prefer PEP 8–style Python (e.g. via tools like `black`, `isort`,
121+
`flake8`, or similar if configured).
122+
- Use descriptive variable and function names.
123+
- Keep functions reasonably small and focused.
124+
125+
- **Security**
126+
- This project manages sensitive authentication material. When changing
127+
code related to crypto, storage, or transport of secrets, review
128+
[`SECURITY.md`](./SECURITY.md) and be conservative.
129+
- Avoid logging sensitive information (keys, secrets, tokens, etc.).
130+
131+
- **Error handling**
132+
- Fail with clear error messages when possible.
133+
- Avoid exposing internal stack traces or sensitive details to end
134+
users by default; log them in a controlled way if necessary.
135+
136+
- **Documentation**
137+
- Update `README.md` (and any relevant docs) when behavior or CLI usage
138+
changes.
139+
- Add or update docstrings for public functions and modules when you
140+
introduce new behavior.
141+
142+
---
143+
144+
### Commit Messages & Pull Requests
145+
146+
- **Commit messages**
147+
- Use concise, descriptive titles (e.g. `Fix vault path resolution`).
148+
- Include additional detail in the body when necessary (what, why, any
149+
relevant side effects).
150+
151+
- **Pull request guidelines**
152+
- Keep PRs focused and as small as reasonably possible.
153+
- Reference related issues (e.g. `Closes #123`) where applicable.
154+
- Describe:
155+
- What changed.
156+
- Why it changed.
157+
- Any breaking changes or migration steps.
158+
159+
---
160+
161+
### Tests
162+
163+
If and when a test suite exists for this project:
164+
165+
- Add tests to cover new functionality and edge cases.
166+
- Ensure all tests pass before submitting your PR.
167+
168+
If tests are not yet present, consider adding a minimal, focused test
169+
covering your change if feasible.
170+
171+
---
172+
173+
### Documentation-Only Contributions
174+
175+
Improvements to `README.md`, `SECURITY.md`, `CONTRIBUTING.md`, examples,
176+
and comments are very welcome:
177+
178+
- Fix typos or clarify instructions.
179+
- Add examples that help others use `passkeys-cli` safely and effectively.
180+
181+
---
182+
183+
### Questions & Support
184+
185+
If you have questions about contributing or need guidance on where to
186+
start:
187+
188+
- Open a **GitHub Discussion** or issue (if Discussions are not enabled).
189+
- For security‑sensitive topics, follow the process in
190+
[`SECURITY.md`](./SECURITY.md) instead of discussing publicly.
191+
192+
Thank you again for helping improve `passkeys-cli`!
193+

0 commit comments

Comments
 (0)