# Contributing

MobilityOps contributions must preserve fleet-data privacy, deterministic demo behaviour and the fail-closed integration boundaries documented in `SECURITY.md`.

- use synthetic vehicles, customers, bookings, returns, telematics events and identity claims in tests and screenshots;
- never commit production databases, exports, operator inventories, private service URLs, tokens, backups or generated browser evidence;
- keep external integrations configurable through environment variables or explicit deployment configuration;
- document new personal-data fields, retention, authorization, audit and deletion/export behaviour;
- add negative tests for authentication, authorization, duplicate handling, webhook validation, path containment and stale/unavailable providers;
- review dependencies, images and browser assets for provenance and redistribution rights.

Run the relevant backend, frontend, migration, integration, Compose and managed-validation gates before review. Security-sensitive findings belong through the private process in `SECURITY.md`.