From b511c9d29b3590e9390c5e184db5ea969913f6ec Mon Sep 17 00:00:00 2001 From: Stysusss <158248053+stysus@users.noreply.github.com> Date: Sun, 16 Aug 2026 01:58:51 +0700 Subject: [PATCH] docs: add community standards (license, contributing, security, templates) - LICENSE: MIT (c) 2026 stysus - CONTRIBUTING.md: dev setup, branch/PR workflow, coding standards - SECURITY.md: vulnerability reporting + scope - Issue templates: bug_report.yml, feature_request.yml - PR template: pull_request_template.md - README: license section updated --- .github/ISSUE_TEMPLATE/bug_report.yml | 48 ++++++++++ .github/ISSUE_TEMPLATE/feature_request.yml | 29 ++++++ .github/pull_request_template.md | 31 +++++++ CONTRIBUTING.md | 100 +++++++++++++++++++++ LICENSE | 21 +++++ README.md | 5 +- SECURITY.md | 44 +++++++++ 7 files changed, 277 insertions(+), 1 deletion(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/pull_request_template.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..c4eff85 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,48 @@ +name: Bug report +description: Create a report to help us improve +title: "[Bug] " +labels: ["Bug"] +body: + - type: textarea + id: description + attributes: + label: Describe the bug + description: A clear and concise description of what the bug is. + validations: + required: true + - type: textarea + id: reproduce + attributes: + label: To Reproduce + description: Steps to reproduce the behavior. + placeholder: | + 1. Go to '...' + 2. Click on '...' + 3. Scroll down to '...' + 4. See error + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + description: A clear and concise description of what you expected to happen. + - type: textarea + id: screenshots + attributes: + label: Screenshots + description: If applicable, add screenshots to help explain your problem. + - type: textarea + id: environment + attributes: + label: Environment + description: OS, browser, and version (e.g. v1.0.0 or commit hash). + placeholder: | + OS: + Browser: + Version: + - type: textarea + id: additional + attributes: + label: Additional context + description: Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..2a1d7fb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,29 @@ +name: Feature request +description: Suggest an idea for this project +title: "[Feature] " +labels: ["Feature"] +body: + - type: textarea + id: problem + attributes: + label: Is your feature request related to a problem? + description: A clear and concise description of what the problem is. + validations: + required: true + - type: textarea + id: solution + attributes: + label: Describe the solution you'd like + description: A clear and concise description of what you want to happen. + validations: + required: true + - type: textarea + id: alternatives + attributes: + label: Describe alternatives you've considered + description: Any alternative solutions or features you've considered. + - type: textarea + id: additional + attributes: + label: Additional context + description: Add any other context or screenshots about the feature request here. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..d79adf7 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,31 @@ +## What does this PR do? + + + +## Related issue + + + +## Type of change + +- [ ] Bug fix +- [ ] New feature +- [ ] Performance improvement +- [ ] Documentation +- [ ] Refactor / chore + +## Checklist + +- [ ] Code follows project coding standards (gofmt / prettier / eslint) +- [ ] `go vet ./...` and `go test ./...` pass (if backend changed) +- [ ] `npm run check` and `npm run lint` pass (if frontend changed) +- [ ] Build passes (`go build ./...` / `npm run build`) +- [ ] Backend/ and frontend/ changes are kept in separate PRs + +## Testing + + + +## Screenshots (if applicable) + + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..5dd7610 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,100 @@ +# Contributing to Neuralwire + +Thanks for your interest in contributing to Neuralwire! We welcome +contributions that improve the platform while keeping the curator model +intact: AI assists, humans decide what gets published. + +Please read our [Code of Conduct](CODE_OF_CONDUCT.md) before participating. + +## Ways to Contribute + +- **Report bugs** — open an issue with clear steps to reproduce. +- **Suggest features** — open an issue describing the problem you're solving. +- **Fix / implement** — fork the repo, create a branch, open a pull request. + +## Development Setup + +### Prerequisites +- Go 1.25+ +- Node.js 24+ +- npm + +### Backend +```bash +cd backend +cp .env.example .env # configure env (defaults work for local dev) +go mod download +go run ./cmd/server # starts on :8080 +``` + +### Frontend +```bash +cd frontend +cp .env.example .env.local # set PUBLIC_API_URL=http://localhost:8080/api +npm install +npm run dev # starts on :5173 +``` + +## Branch & PR Workflow + +This repo uses a two-branch workflow with branch protection: + +``` +development (work freely, CI runs, no deploy) + │ push + open PR + ▼ +main (protected, CI must pass, deploys to production) +``` + +1. Create a feature branch from `development`. +2. Commit and push. CI runs on every push. +3. Open a **Pull Request** to `main`. +4. CI must pass: + - `Build, vet & test` (backend) + - `Install, check, lint & build` (frontend) +5. A maintainer reviews and merges. + +> `main` is protected: direct pushes are blocked and all commits must come +> through PRs with green CI. + +## Coding Standards + +### Backend (Go) +- Run `gofmt` before committing (`gofmt -l .` must output nothing). +- Run `go vet ./...` and `go test ./...` locally. +- Keep dependencies minimal; prefer the standard library. + +### Frontend (SvelteKit) +- Run `npm run check` (svelte-check) and `npm run lint` (prettier + eslint). +- Keep TypeScript types strict. +- Do not modify `backend/` in frontend PRs and vice versa. + +## Commit Messages + +Write concise, descriptive commit messages that explain the *why*: + +``` +type(scope): short summary + +Body explaining context, especially non-obvious decisions. +``` + +Examples: +- `feat(api): add admin image upload endpoint` +- `fix(ui): article share buttons open correct share URLs` +- `perf(db): add index on news(url)` +- `docs: add contributing guide` + +## Project Structure + +``` +backend/ Go REST API + scheduler +frontend/ SvelteKit app (adapter-static) +.github/ CI workflows +``` + +See the root [README](README.md) for full details. + +## Questions? + +Open an issue or reach out via the contact in our [Security Policy](SECURITY.md). diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..008d333 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 stysus + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index ff1c8f2..d184650 100644 --- a/README.md +++ b/README.md @@ -399,4 +399,7 @@ Tracked in Linear (project: NEURALWIRE): ## License -© 2026 NEURALWIRE MEDIA. All rights reserved. +MIT License — see [LICENSE](LICENSE). + +© 2026 NEURALWIRE MEDIA. All rights reserved for curated content; source code +is licensed under MIT. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..1857b1a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +## Reporting a Vulnerability + +We take security seriously. If you discover a security vulnerability in +Neuralwire, please **do not** open a public issue. Instead, report it +privately so we can fix it before it is disclosed. + +**Email:** stysus@proton.me + +Please include: +- A description of the vulnerability. +- Steps to reproduce (if possible). +- Affected version / commit. +- Any suggested fix (optional). + +We aim to acknowledge reports within 3 business days and will keep you +updated on progress. + +## Scope + +In scope: +- The Go backend (REST API, scheduler, auth, rate limiting). +- The SvelteKit frontend (XSS, CSRF, client-side issues). +- Deployment configuration (Docker, env handling). + +Out of scope: +- Content of curated articles (copyright issues go through the DMCA page). +- Third-party services (Railway, Cloudflare, GitHub) — report to their + respective programs. + +## Supported Versions + +The latest `main` branch is the supported version. Releases are tagged (e.g. +`v1.0.0`); older releases are supported on a best-effort basis. + +## Security Features + +- Bearer-token admin auth with constant-time validation. +- CSRF protection on admin mutations. +- Rate limiting (login, views, global). +- Security headers (CSP, X-Frame-Options, nosniff, HSTS via Cloudflare). +- Production hardening: refuses to boot with default credentials. +- `APP_ENV=production` guard in `cmd/server/main.go`.