The ten minimum guidelines for code contributions are:
- All Pull Requests must be based on the
masterbranch. - Raise an issue and ask to be assigned before raising a pull request.
- Make sure you have made a search through closed issues in case your question or issue has already been addressed.
- All PRs should have a dedicated scope (e.g., not mixing code refactorings with delivering a new feature) and a reasonable size.
- All new and changed code should have a corresponding unit and/or integration test.
- Noise (e.g., unnecessary comments) generated by AI tools must be removed before opening a PR.
- All Git commits within a PR must be signed off to indicate the contributor's agreement with the Developer Certificate of Origin.
- Particularly low-effort contributions (e.g., incomplete typo fixes in a single file, trivial text changes, code formatting) or any forms of potential "contribution farming" must not be submitted as PRs. Doing so more than once might be considered spamming and handled accordingly.
- Opening multiple issues or pull requests using AI without having asked, tested, or verified that the bug needs to be fixed will be considered spamming and may cause you to be banned for 30 days. Repeated offenders will be blacklisted through OWASP.
- Communication about PRs and Issues happens in public, and all communication is expected to adhere to the Code of Conduct, not violate the Foundation's by-laws, and be in accordance with any other relevant policy the Foundation maintains.