Contribute to Open Source

# Contributing to <project>

Thanks for taking the time to contribute!

## Getting started

1. Read the README and run the project locally (`npm ci && npm run dev`).
2. Look for issues labeled `good first issue` - they are scoped and newcomer-safe.
3. Comment on the issue you want to work on so maintainers know it is taken.

## Branch & commit conventions

- Branch names: `fix/description`, `feat/description`
- Commits follow [Conventional Commits](docs site): `fix:`, `feat:`, `docs:`, ...
- Keep changes small and focused. One issue = one PR.

## Making a pull request

1. Fork the repo and create your branch.
2. Write tests for your change (we run coverage in CI).
3. Run `npm test` and `npm run lint` - both must pass.
4. Open the PR against `main` and fill out the template.
5. A maintainer will review within 48 hours. Push fixes as new commits.

## Code of conduct

All contributors must follow our Code of Conduct. Please treat others with
respect - maintainers and contributors are volunteers.

## What does this PR do?

<!-- One or two sentences. What changed and why. -->

Fixes #<issue-number>

## How was it tested?

- [ ] Unit tests written/updated
- [ ] Local run verified (`npm run dev`)
- [ ] Lint & type-check pass

## Checklist

- [ ] Commit messages follow Conventional Commits
- [ ] No unrelated changes in this PR
- [ ] Docs updated if behavior changed

## Screenshots (if UI change)

<!-- Optional -->

name: Bug report
description: Report a bug to help us improve
labels: [bug]
body:
  - type: textarea
    id: description
    attributes:
      label: Description
      description: What happened vs what you expected.
    validations:
      required: true
  - type: input
    id: version
    attributes:
      label: Version
      description: Package version or commit SHA you are on.
    validations:
      required: true
  - type: textarea
    id: steps
    attributes:
      label: Steps to reproduce
      description: Minimal reproduction steps or a link to a repro repo.
    validations:
      required: true
  - type: textarea
    id: environment
    attributes:
      label: Environment
      description: OS, Node version, browser, etc.

# Security Policy

## Reporting a vulnerability

Please do **not** open a public issue. Report privately:

- Email: security@example.com (PGP key: <link>)
- Or: GitHub private vulnerability reporting
  (Repos → Settings → Security → Private vulnerability reporting)

Include: affected version, steps to reproduce, and impact.

## Response time

- Acknowledgment: within 48 hours
- Triage: within 7 days
- Fix release: as soon as a patch is ready; we coordinate disclosure

## Supported versions

| Version | Supported |
| ------- | --------- |
| latest  | yes       |

Older versions receive security fixes on request when the fix is low-risk for
all consumers to upgrade.