13 lines
1.1 KiB
Markdown
13 lines
1.1 KiB
Markdown
# Contributing
|
|
|
|
MobilityOps contributions must preserve fleet-data privacy, deterministic demo behaviour and the fail-closed integration boundaries documented in `SECURITY.md`.
|
|
|
|
- use synthetic vehicles, customers, bookings, returns, telematics events and identity claims in tests and screenshots;
|
|
- never commit production databases, exports, operator inventories, private service URLs, tokens, backups or generated browser evidence;
|
|
- keep external integrations configurable through environment variables or explicit deployment configuration;
|
|
- document new personal-data fields, retention, authorization, audit and deletion/export behaviour;
|
|
- add negative tests for authentication, authorization, duplicate handling, webhook validation, path containment and stale/unavailable providers;
|
|
- review dependencies, images and browser assets for provenance and redistribution rights.
|
|
|
|
Run the relevant backend, frontend, migration, integration, Compose and managed-validation gates before review. Security-sensitive findings belong through the private process in `SECURITY.md`.
|