# Contributing

Keep Ludarium changes portable, legally redistributable and safe for private libraries.

- Branch from the protected default branch.
- Use synthetic metadata and homebrew/public-domain fixtures; do not commit ROMs, firmware, keys, private library databases or account data.
- Document the origin, license and checksum expectations for emulator components, icons, metadata sources and any bundled asset.
- Keep player URLs, bind addresses and storage roots configurable; examples must not contain operator-specific infrastructure.
- Add tests for behavioural changes and run the documented .NET, frontend, container and managed validation gates.
- Explain schema, migration, content, player-isolation, security and deployment impact in the pull request.

Report vulnerabilities according to `SECURITY.md`.