docs: add fleet privacy contribution guidance

2026-08-31 07:53:43 +02:00
parent f8eff37982
commit 70e2648b03
1 changed files with 12 additions and 0 deletions
@@ -0,0 +1,12 @@
 # Contributing
 MobilityOps contributions must preserve fleet-data privacy, deterministic demo behaviour and the fail-closed integration boundaries documented in `SECURITY.md`.
 - use synthetic vehicles, customers, bookings, returns, telematics events and identity claims in tests and screenshots;
 - never commit production databases, exports, operator inventories, private service URLs, tokens, backups or generated browser evidence;
 - keep external integrations configurable through environment variables or explicit deployment configuration;
 - document new personal-data fields, retention, authorization, audit and deletion/export behaviour;
 - add negative tests for authentication, authorization, duplicate handling, webhook validation, path containment and stale/unavailable providers;
 - review dependencies, images and browser assets for provenance and redistribution rights.
 Run the relevant backend, frontend, migration, integration, Compose and managed-validation gates before review. Security-sensitive findings belong through the private process in `SECURITY.md`.