Development and Contributing

Development and Contributing

The canonical contribution rules are maintained in CONTRIBUTING.md. This page provides a short navigation guide.

Before You Start

• Read the Code of Conduct.
• Search existing issues and roadmap items.
• Use the dedicated integration form for new scanners or tools.
• Discuss substantial architecture or security-boundary changes before coding.
• Use only authorized, non-production targets during development.

Local Validation

python -m compileall src
docker build -t lophiarch:test .

Build any scanner worker affected by the change:

docker build -f Dockerfile.nmap -t lophiarch-nmap:latest .
docker build -f Dockerfile.ffuf -t lophiarch-ffuf:latest .
docker build -f Dockerfile.nuclei -t lophiarch-nuclei:latest .

For Helm changes:

helm lint deploy/helm

The project does not yet have a complete automated test suite. Pull requests must state what was validated and explain any test limitations.

Pull Requests

The pull request template asks for:

• Summary and related issue.
• Type and implementation details.
• Exact validation commands and results.
• Security and authorization review.
• Documentation and compatibility impact.
• Confirmation of the dual-license contribution terms.

Keep changes focused. Avoid bundling unrelated rewrites.

Licensing

Lophiarch uses the SPDX expression:

MIT OR Apache-2.0

Unless explicitly stated otherwise, intentionally submitted contributions are provided under the same dual-license terms.

Security Reports

Do not submit a pull request or issue that publicly reveals an unpatched Lophiarch vulnerability. Follow the Security Policy.