# Contributing

1. Open an issue for a substantial bug or feature.
2. Keep platform-specific changes isolated where practical.
3. Add or update tests for behavior changes.
4. Update documentation when user-facing behavior changes.
5. Do not commit private keys, PFX/P12 files, API credentials or other signing secrets.
6. Do not claim a release is signed/notarized unless the corresponding verification exists.

For release/security changes, include the affected workflow and verification path in the pull request description.