Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
73 lines (53 loc) · 2.36 KB

CONTRIBUTING.md

File metadata and controls

73 lines (53 loc) · 2.36 KB
Raw

Contributing

Thanks for taking the time to improve Keysoft.

Keysoft is security-sensitive software. Changes should be small, reviewable, and backed by tests when they affect authentication, cryptography, storage, biometrics, import/export, notifications, or release configuration.

Development Setup

bun install --frozen-lockfile
bun run start

Use Bun 1.3.14 and Node.js 22.13 or newer. The lockfile is part of the reviewed dependency graph and must remain frozen during clean validation.

Android development uses Expo Go for day-to-day work. Release-grade validation for Argon2 and native modules requires an EAS/native Android build.

Before Opening A Pull Request

Run:

bun run verify
bun run deps:audit

For Android release-related changes, also run:

bunx expo export --platform android --output-dir C:\tmp\keysoft-android-export

Repository Access

The main branch is protected. External contributors should submit changes through pull requests; direct pushes are reserved for the repository owner. Pull requests require the Validate CI check and one approving review before merge.

Security Rules

  • Do not commit keystores, certificates, passwords, tokens, .env files, or anything from .secrets/.
  • Do not log PINs, vault keys, passwords, note content, backup payloads, or biometric SecureStore values.
  • Use src/utils/cryptoRandom.ts for randomness.
  • Keep user-visible strings in both src/locales/it.ts and src/locales/en.ts.
  • Keep the in-app and public Mikesoft privacy notices aligned when changing permissions, networking, updates, backups, biometrics, clipboard behavior, profile images, key derivation, or supported platforms.
  • Treat changes to KDF parameters, vault encryption, biometric unlock, and backup formats as security-sensitive.

Pull Request Style

Use focused PRs with:

  • A concise summary of behavior changes.
  • Tests run and their results.
  • Screenshots only for UI changes.
  • Explicit notes for migrations, release config, permissions, or security tradeoffs.

Contribution License

By submitting a contribution, you attest that you have the right to submit it and certify that it is provided under Apache-2.0. You must disclose any third-party material included in the contribution and its applicable license. This is not a contributor license agreement and does not transfer or assign copyright.