From 70e2648b03dfcf5deb712fdec14e3db74a739994 Mon Sep 17 00:00:00 2001 From: Jens Caers Date: Mon, 31 Aug 2026 07:53:43 +0200 Subject: [PATCH] docs: add fleet privacy contribution guidance --- CONTRIBUTING.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..4abab22 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,12 @@ +# Contributing + +MobilityOps contributions must preserve fleet-data privacy, deterministic demo behaviour and the fail-closed integration boundaries documented in `SECURITY.md`. + +- use synthetic vehicles, customers, bookings, returns, telematics events and identity claims in tests and screenshots; +- never commit production databases, exports, operator inventories, private service URLs, tokens, backups or generated browser evidence; +- keep external integrations configurable through environment variables or explicit deployment configuration; +- document new personal-data fields, retention, authorization, audit and deletion/export behaviour; +- add negative tests for authentication, authorization, duplicate handling, webhook validation, path containment and stale/unavailable providers; +- review dependencies, images and browser assets for provenance and redistribution rights. + +Run the relevant backend, frontend, migration, integration, Compose and managed-validation gates before review. Security-sensitive findings belong through the private process in `SECURITY.md`.