Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
64 lines (49 loc) · 2.22 KB

CONTRIBUTING.md

File metadata and controls

64 lines (49 loc) · 2.22 KB
Raw

Contributing to RateGuard

Thanks for helping. Ground rules first — they exist so the tool stays trustworthy.

Non-negotiables

  • Offline only. No network calls, telemetry, or phone-home of any kind in the scanners, core, reporters, or fix generator. The GitHub Action is the only component allowed to use the network, and only through @actions/github.
  • Four frameworks in v1. Express, FastAPI, Next.js, Supabase Edge Functions. Do not add a fifth without an open issue and maintainer sign-off.
  • Zero-config by default. Detection should work against a plain clone of a repo. Nothing the user has to set up to get a useful scan.

Dev setup

git clone <repo>
cd rateguard
npm install
npm run build
npm test
npm run coverage

Layout

src/
  cli.ts            — commander wiring, exit-code policy
  core/
    scan.ts         — walks the dir, dispatches to scanners, classifies
    classify.ts     — severity heuristics
    protection.ts   — shared "is this protected?" helpers
    scandir.ts      — file discovery (.gitignore-aware)
    fixGenerator.ts — per-framework fix snippets
    diffWriter.ts   — unified diff + atomic write + backup
  scanners/
    express.ts fastapi.ts nextjs.ts supabase.ts
  reporters/
    table.ts json.ts
action/             — GitHub Action (built with @vercel/ncc)
test/
  fixtures/         — vulnerable/protected sample projects
  *.test.ts         — vitest units + CLI integration

Adding a detection heuristic

  1. Write a failing test in test/scanners.test.ts with an inline fixture.
  2. Implement in the relevant scanner. Prefer AST over regex; add a regex fallback for unparseable files.
  3. If the heuristic is shared across frameworks, put the helper in src/core/protection.ts and import it.

Style

  • TypeScript, strict, ESM-free runtime (CJS build for the CLI & ncc).
  • Keep scanners pure: scan*(file, src) in, Route[] out. No I/O beyond what's passed in.

Pull requests

  • One logical change per PR.
  • Tests green: npm test.
  • Coverage: npm run coverage — src/core and src/scanners must stay ≥ 80%.
  • Action build passes: npm run build:action.

License

By contributing you agree your work is released under the MIT license.