Welcome to PhishGuard AI: roadmap and contribution guide

[omobolajiadeyan]

Welcome to PhishGuard AI, an explainable, offline phishing detection project created and maintained by Omobolaji Adeyan.

What is available today

• URL and email heuristic risk scoring with named feature output
• Native JSON and SARIF 2.1.0 reporting
• GitHub Code Scanning integration
• Python 3.10-3.13 testing, CodeQL, installable wheel and CLI
• A documented detection model, security policy, roadmap, and attested release process

The current stable release is v0.3.0. Work on the next release is tracked in the Unreleased changelog.

Current community work

Two contributions are actively under review:

• #6: batch source locations in SARIF
• #7: plain ASCII CLI output

Please review or suggest tests on those pull requests instead of opening duplicate implementations.

Available scoped tasks include:

• #2: conservative IDN and punycode signals
• #3: labeled URL evaluation benchmark

Comment on an issue with your proposed approach before starting substantial work. The contributor guide and development workflow describe setup, verification, safe test data, review, and contributor credit.

Engineering standard

Useful contributions are focused, reproducible, tested, explainable, and conscious of false positives. Passing CI is required, but technical review still considers behavior, security, scope, and documentation. Accepted contributors are credited in AUTHORS.md.

Use Discussions for design questions and detection ideas. Use public issues for non-sensitive bugs and planned work. Security-sensitive reports belong in the private vulnerability reporting form, not a public issue.

Thank you for helping build security software that people can inspect, test, and improve.