Hacktoberfest 2026: where to start

[NovaCode37]

PRISM takes Hacktoberfest pull requests this year. Merged PRs get the hacktoberfest-accepted label, so they count.

Already merged in October: #438 (--modules rejects unknown names), #441 (translation contract tests), #443 (CodeQL scoped to source), #449 (upload size check that no longer trusts a header), #440 (GraphML and GEXF export from the CLI), #439 (translated card titles and tooltips), #444 (translated aria-labels), #450 (one CoinGecko request instead of three), #452 (github_recon no longer says "ok" when rate limited), #455 (hlr_lookup reports failed sources), #460 (the crypto panel explains a missing USD value), #462 (the GitHub card shows what was not checked), #463 (no more silent plain-HTTP fallback for Numverify), #468 (tests for metadata_extractor and url_scanner), #471 (webhook delivery pinned to the checked IP), #473 (crt.sh and Wayback report rate limits), #478 (WHOIS, GeoIP, DNS and site analysis statuses), #466 (the first AI agent PoC in experiments/agent), #476 (watchlist ids validated like scan ids), #467 (subnet calculator translated into all ten languages), #488 (Shodan 404 is an answer, not an error), #489 (the OPSEC score says NOT ASSESSED when nothing was checked), #494 (Censys docs name the variables the code actually reads), #495 (metadata extractor statuses, and a crash on a missing file), #503 (both report templates rendered in CI), #504 (darkweb_search tests and statuses), #505 (prism modules), #506 (rate-limited modules keep their data, failed ones explain why), #508 (risk levels checked across backend and frontend), #502 (metadata_extractor availability probes), #507 (the Topbar clock without a setState in an effect), #515 (translated empty and loading states), #516 (prism modules says when maigret is missing), #517 (grouped dependabot updates), #522 (scan comparison ignores timings), #523 (translated email card warnings), #524 (AbuseIPDB failures reported as errors), #525 (a missing GitHub user is an answer, not an error), #527 (GITHUB_TOKEN and maigret variables documented), #529 (CI runs before a release image is published). Thanks to everyone who sent them.

Where to start. Everything open for it carries the hacktoberfest label. Roughly by how much of the codebase you need to know:

• Docs, no code needed: Document the CLI in docs/CLI.md #512 a proper docs/CLI.md.
• Tests: Tests for qr_decoder #413 qr_decoder, Tests for the scan result endpoints, including that one user cannot read another's scan #446 the scan result endpoints, including that one user cannot read another's scan.
• Small, contained changes: Hash cache filenames with sha256 instead of MD5 #388 cache filenames from MD5 to sha256, Email header analysis never finds an IPv6 origin, and lets some non-public IPv4 ranges through #456 email headers that never find an IPv6 origin, crypto_lookup, smtp_verify, hunter and darkweb_search: move to module_status #470 and Move the last six modules onto module_status #493 moving the last modules onto module_status, Share one HTTP failure helper instead of copying it per module #485 one shared HTTP failure helper, A GitHub user that does not exist renders as an empty card #531 a GitHub user that does not exist, Drop the unused dataclasses-json and move test tooling out of requirements.txt #533 cleaning up requirements.txt, onion_checker always finds nothing: Ahmia wants a token and DarkSearch is dead #535 an onion search that always finds nothing.
• Frontend: Translate the field labels inside the result cards (about 66 left in English) #464 translate the field labels inside the result cards, Two strings are still English in every locale, and nothing checks for it #532 two strings still in English everywhere, Migrate the frontend to Tailwind CSS 4 #510 the Tailwind 4 migration, Fix the React Compiler lint errors that Next 16 surfaces #411 React Compiler warnings, one file per PR, and The frontend has no way to test a component #416 a way to test a component at all.
• Translations: Review a translation in your own language #347, review the UI in a language you speak natively.
• Bigger ones if you want something to chew on: Put the rest of the modules behind get_with_retry #392 retries for the remaining modules, The CLI can make a report but cannot read one back #417 reading a report back in the CLI, [FEATURE] Building out the AI OSINT agent from the roadmap #459 the AI OSINT agent.

How it works here

• Comment on the issue before you start, so two people do not do the same thing. I assign within a day.
• One issue per PR. A PR that touches ten unrelated files will be asked to split.
• Tests have to pass with no network access. CI runs them.
• PRs that change a typo in the README, add yourself to a list, or reformat a file will be closed and labelled invalid, which also means they do not count.

Questions about an issue go on the issue; anything else, ask here.

Done one here and want another? I also maintain claude-security-skills: security checks in plain Python with no dependencies, where most issues are adding one detection rule to one engine. Same rules, same fast reviews: start here.