Contributing

Thanks for helping. protestchat is security software for people under stress — careful changes matter more than fast ones.

Before you start

Read docs/THREAT-MODEL.md and docs/FORWARD-SECRECY.md if you touch crypto, mesh, or BLE.
Prefer a focused PR that closes one issue over a kitchen-sink patch.
If you change user-visible mode warnings or safety claims, update the user guide in website/ in the same PR (docs-as-code — see #11).

npm install
npm run doctor    # names toolchain fixes
npm test
npm run typecheck

Expo Go will not work (custom native BLE). Use a development build:

npm run android   # or npm run ios

Keep the diff reviewable; separate unrelated fixes into separate PRs.
Add or update tests for protocol/crypto/mesh behavior.
Do not claim new security properties in the README or user site without threat-model updates.
Fill in the PR template.

Do not open a public issue for an exploitable vulnerability. See SECURITY.md.

Participation is governed by CODE_OF_CONDUCT.md.