Contributing
Octa Pass is built but not released, and it hasn’t had its external audit. This is the best time to influence it.
Ways to help
Section titled “Ways to help”| Area | How |
|---|---|
| Design review | Read the security overview and threat model and open an issue with anything that looks wrong. Cryptographers and security engineers are especially welcome. |
| Documentation | Fix unclear pages, add import guides, improve examples. See writing docs. |
| Code | The core, server, apps and website are all in the repository. See development setup. |
| Translations | The apps, website and docs are in English and Arabic (see languages). Fixes are welcome, and more languages come through Weblate. |
| Security | Report vulnerabilities privately as described in SECURITY.md. Please don’t open public issues for them. |
Ground rules
Section titled “Ground rules”- No ads, trackers or third-party scripts anywhere in the project.
- Changes to cryptography, keys, authentication, sync or autofill need a security section in the pull request description.
- Notable changes get a changelog entry.
- Be kind. We follow the code of conduct.
Sign-off, not a CLA
Section titled “Sign-off, not a CLA”Octa Pass uses the Developer Certificate of Origin. Sign off each commit:
git commit -s -m "docs: clarify recovery code rotation"There’s no Contributor Licence Agreement: you keep the copyright to your work and license it under MIT. See licence.
AI-assisted contributions
Section titled “AI-assisted contributions”AI tools are welcome. Agents working in the repository must follow AGENTS.md, and the human contributor is the author of every commit. See docs for AI agents.